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CHAPTER 1. INTRODUCTION 


1.1 Research background and approach 


The ultimate purpose of the social sciences is to discover a method of making people in 
society stronger and wealthier and making society as a whole more prosperous and secure. 
The future belongs to the strong and the wealthy, simply because there should no longer be 
the weak and the poor. The factors by which people’s welfare is improved are however, 
constantly changing, because the future is a continuing uncertainty. 

Our society is experiencing a continuous transition from a natural physical environment 
to a constructed physical environment and from a natural social environment to a constructed 
social environment (Coleman, 1990). Recent décades hâve witnessed a golden âge in social 
history, previously symbolized by long wars and disasters, but now showing a scene of 
unparalleled development in information and communications technology (ICT) 1 and related 
material fonns of computers and networks. In both academie and popular discourses, 
newly-coined words indicate that the information âge has arrived 2 and an information 
society has emerged. 3 The émancipation of the Internet from monopolistic control to open 


A note on references: Key notes, particularly those relating to the author’s key lines of argumentation, 
are placed as footnotes. References to books and other material that are to be considered as 
background sources for the dissertation hâve been placed, in brackets, in the body of the text itself. 

1 No unified définition exists for information and communications technology, or information 
technology. However, it is acceptable to define it as a term that “describes the whole range of 
processes for the acquisition, storage, transmission, retrieval and processing of information” (King 
1982, p. 35). It “is the term used to refer to the integrated use of informatics, information and 
communication tools and infrastructure to assist in the dissémination of knowledge” (Franklin 2006, p. 
1). In 1998, the OECD defined ICT industry as “a combination of manufacturing and services 
industries that capture, transmit and display data and information electronically” (OECD 2002b, p4). 

2 The term “information âge” was coined by Wilson Dizard in the book “The Corning Information 
Age: An OverView of Tec hn ology, Economies, and Politics”, Longman, 1982. 

3 Information society is a society in which économie and cultural life is critically dépendent on 
information and communications technology. The possible ways of defining information society 
comprise technologie al, économie, occupational, spatial, cultural and quantitative approaches (Webster 
2001). Roughly speaking, information society is a phase where social life is information dépendent, 
information abundant, and information shared. At the World Summit on the Information Society 
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access to the public at the end of the twentieth century brought about a revolutionary epoch 
for human beings (Adamson, p. 37). The transition eliminated primary obstacles to 
information accessibility. That ICT reshapes business, the economy, éducation, entertainment, 
the media, the military, politics, as well as other social institutions in remarkable ways has 
already become a well-established coinmon viewpoint. Few in international societies deny 
the fact that ICT is bénéficiai to States, organizations and individuals: it is an influential tool 
of development for the économies, a mechanism offering opportunities to overcome various 
traditional obstacles to development; and a medium increasing individuals’ active 
participation in social affaire and improving their compétence in markets. 4 Reality 
sufficiently justifies the discourse: up to date, the global networks of information Systems 
hâve connected approximately 1.15 billion people (Internetworldstats.com 2007). More than 
one-fourth of them are online Europeans, who hâve the pénétration rate of 39.8 percent (Ibid). 
In the European Union alone, the 255.58 million Internet users represent an average of more 
than half the whole population in these countries (Ibid). 

Infonnation Systems are designed to serve people. 5 Application of the Internet has 
created a focus of attention for an increasing number of individuals, organizations and 
govemmental agencies. The networks connect a formerly offline population into an online 
cyberspace, 6 which is relatively separated from and independent of traditional society. It is 


(WSIS), world leaders declared that an “information society” was a “people-centred, inclusive and 
development-oriented” society, “where everyone can create, access, utilize and share information and 
knowledge, enabling individuals, communities and peoples to achieve their full potential in promoting 
their sustainable development and improving their quality of life, premised on the purposes and 
principles of the Charter of the United Nations and respecting fully and upholding the Universal 
Déclaration of Human Rights” (WSIS 2003, Section A, paragraph 1). The information society is 
characterized by being "more interconnected; more interactive; more instantaneous (fast-paced); more 
information rich; more informai; more affordable; and more uncertain." (OECD 1998, p. 13). 

4 The Commonwealth, Malta Déclaration on Networking the Commonwealth for Development, 
Commonwealth Heads of Government Meeting (CHOGM), 25-27 November 2005. 

5 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the 
Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of 
such Data, Preamble (2). 

6 Cyberspace is a term coined by William Gibson in Neuromancer (Gibson, 1984). An a popular 
définition of cyberspace, it includes ail of the computers and other digital devices that are connected to 
both internai and extemal networks and can communicate with each other (Sadowsky and co-workers 
2003, p. 16). In recent years, the prefix “cyber-” has been widely used in both academie works and 
govemmental documents. The original meaning of “cyber” means computer (Pickett and co-workers, 
2000). However, this prefix was not broadly used before computer networks became common. In fact, 
the origin of the prefix "cyber" has been traced back to human-machine interconnection (Jones 2003, p. 
112). Therefore, the public understanding of this prefix relates to the meaning of computer networks, 
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considered as a Virtual environment where netizens 7 live a Virtual life, communicating with 
e-mail, chat rooms, instant messenger, and the bulletin-board System. They engage in 
teleworking; 8 going e-shopping; and are educated partially by means of computer-assisted 
leaming, 9 taking part in net-based courses; and carrying out e-commerce through electronic 
marketing. 10 It is often anticipated that e-govemment will govem them by means such as 
e-govemance. 11 This virtual society is, however, still in the imagination or expectation, and 
society is far from splitting into a traditional society and a cyber society. However, at the 
same time, we cannot simply ignore the great influence of projects such as “Europe’s 
Infonnation Society.” 12 To extend Coleman’s social theory (1990), I would rather say that 
there are signs of a cyber physical environment and of a cyber social environment, which is 
being constructed on information Systems and by netizens anned with infonnation. 

Unfortunately, infonnation Systems are likely to crash, and likely to cause disputes and 
lawsuits. Furthermore, the order of cyberspace, closely associated with the welfare of 


particularly the Internet. In this dissertation, I also use this prefix in terms of computer and computer 
networks, but the emphasis is put on the whole information System rather than simply on the hardware. 
7 Netizen is a term used to indicate citizen in the Internet community, the counterpart of which is a 
citizen in the traditional community. 

s According to Daintith (2004, p. 529), when computers and télécommunications are used in remote 
working, usually outside office, the activity is called teleworking. For detailed discussion and 
prospects on the teleworking environment, Shoni, Jackson, Hollmen and Aspnàs (eds., 1998). 

9 Computer-based leaming is usually termed as e-leaming, or CBT (computer-based training) 
(Rosenberg, 2001). 

10 Commerce has been developing from traditional commerce through c-commerce (computerised 
commerce (Royall and Hughes 1990, p. 8), e-commerce to m-commerce. E-commerce is the 
abbreviated form of electronic commerce, referring to commerce using electronic media, usually, the 
Internet (Daintith 2004, p. 173). At présent, when people say e-commerce, the general meaning of this 
term is commerce through the Internet. As far as commerce through the mobile network is concerned, 
people utilize the term m-commerce. 

11 According to Bhamagar (2004, p. 21), “the term e-government is sometimes confused with 
e-govemance and the two terms are often used interchangeably. E-govemance has been defmed as the 
process of enabling transactions between concerned groups and the government through multiple 
channels by linking ail transaction points, decision points, enforcing/implementation points and 
repositories of data using information and communication technologies, to improve the efficiency, 
transparency, accountability and effectiveness of a government.” 

12 European Commission, Europe’s Information Society-Thematic Portai. Retrieved 15 Mardi 2007, 
from http://ec.europa.eu/information_society/index_en.htm 

13 In KKO:1988:103, a lawsuit was brought about on employee’s holiday compensation miscalculated 
due to the fault of the computer programme. In KKO:2005:3, the issue in dispute was that the 
advocate of a convicted person had sent an appeal against the conviction through an e-mail message 
and within the time limit, but the advocate received an answer in the form of an e-mail message from 
the court, stating that no e-mail massage had ever arrived and so no appeal had been received against 
the conviction within the time limit. 
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citizens, the security of businesses, and the stability of society is, however, becoming 
increasingly signifîcant, due to increased scale of the online population to over one-sixth of 
the inhabitants of the globe. What is problematic in the landscape of the social sciences is that 
many technological loopholes are constantly being exploited with malicious intent, while 
technological opportunities are, at the same time, generating various benefits as well. Hence 
chaos, disorder, social problems, and more severely, crimes pose great threats to the security, 
reliability, and credibility of the infonnation society. 

Cybersecurity has extended its influence into “méat space”, that is, real society, and 
caused widespread concems among various entities. It has long been recognized as one of the 
issues deserving considération in nonnal social life (for example, Aromaa and Laitinen 1994, 
pp. 47-101). As a typical example, the American Computer Science and Télécommunications 
Board of National Research Council (2002, pp. 1-2) has stated that, cybersecurity has always 
been the central concern in a sériés of their research studies in the past decade. It is also true 
for many other institutions, which invest considérable human resources and financial 
resources in their work. 14 Cybercrimes, 15 criminal offences committed by netizens in 
cyberspace, are new variants of criminal phenomena. This raises many questions as to 
whether the existing legal System has the capability of deterring cybercrimes. 

The development of crime is closely related to social transfonnation at both the micro 
and the macro levels. Two factors symbolize the severity of this criminality: On the one hand, 
it is growing at a rapid speed; on the other hand, it is a serious problem for both private and 
public sectors (Bequai 1983, p. 3). For the public, everyone faces the threat with same 
accélération. With the emergence, development, and rampancy of cybercrime, 
cybercriminology, a new discipline, is acquiring an independent position. The studies of 
cybercriminal phenomena, its causes and motivations, and models for the prévention of 
cybercrime, compose the essential outline of cybercriminology. In this dissertation, 
cybercriminal phenomena constitute the corner-stone of the theoretical framework. Définition, 

14 It is neither necessary nor possible to give an academically exhaustive list of these institutions. But 
I would like to empirically name a few: the UN, the EU, the CoE, the OAS, the APEC, the ASEAN, 
the OECD, the FBI, the ITU, etc. 

15 Perrin (2005) stated that the term cybercrime was coined in the late 1990s when the G8’s Lyon 
Group used the term to describe criminal phenomena existing in the information and communications 
networks. 
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classification, motivation, and prévention are the primary architectural materials of an 
analytical construction. 

Traditionally, criminology has been composed of a variety of parallel théories in 
explaining criminal phenomena in general and as well as in spécifie offences. Causal factors 
and deterrence hâve constantly been the focuses of many different schools in this field. 

Cohen and Felson’s routine-activity theory (1979) provides a trichotomized method in 
reducing causal factors of crime to presence of motivated offenders and potential victims, and 
to the absence of effective guardianship. Broad attention has been paid to the theory in the 
last two décades. Grabosky and co-workers (2000) hâve applied the routine-activity theory to 
explain the causes of certain theft offences in cyberspace, stating that cybercrime might be 
explained by the combination of three factors: motivation, opportunity and the absence of 
capable guardianship, just like crime in general (See also Grabosky 2000, p. 1). This 
dissertation continues the analysis that Grabosky and co-workers hâve started, and seeks to 
incorporate the three factors in Cohen and Felson’s theoretical structure (1979) into social 
disorganization theory. 

Social change has both physical and psychological conséquences for society and people, 
as well as for control mechanisms. Thus social change theory can well be installed at the 
sublevel of the routine-activity theory to reinforce the latter’s explaining power during rapid 
social transformation. 

Another theory is the social disorganization theory initiated by Thomas and Znaniecki 
(1927) and developed by Cooley (1983). The disorganization of society has broad physical 
and psychological impacts. At the same time, it means the disintegration of the existing 
social-control mechanisms. 

The reason for the incorporation of social change theory into the social disorganization 
theory is that the prevalence of infonnation and communications technology and the 
prolifération of infonnation itself signifies a great social transformation from members of 
society being weakly informed to members of society being more strongly informed. During 
this process, the old setting of previous social structure and relations that facilitated 
information access has been reshaped into a new set of social structures and relations. In the 
sense that the old order was dissolved while the new order has not fully established, there 
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emerges a period during which a new process of social disorganization is occurring. 

Social change not only directly leads to the presence of potential offenders and victims, 
as well as to the ineffectiveness of guardianship, but also leads to social disorganization. 
Furthermore, social disorganization not only happens as a resuit of social change, but also 
happens because of other factors. Whatever the reasons by which social disorganization 
emerges, it will lead to the triplet factors (motivated offenders, exposure of victims, and 
absence of guardianship) that influence the occurrence of crime. 

By now, the interweaving of social change theory, social disorganization theory and 
routine-activity theory renders a useful explanation of the criminal phenomena on the Internet, 
as Figure 1 illustrâtes. 


Information 

pervasion 






Figure 1 Interrelational Structure of Three Factors 


When our academie activity involves analysing criminal phenomena, we naturally relate 
this social problem to the whole society. When our efforts are directed at tackling this 
problem, regardless of whether we are able or unable to erase these clouds from society, we 
flrst seek help from law. In fact, cybercrime is usually regarded as a legal phenomenon 
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regulated through criminal law, which is a branch of law that has the longest history, dealing 
as it does, with issues of crime and punishment. Feldman (1993, pp. 4-6) claimed that 
criminal law has a moving border accommodating crimes of various forms, implying that 
offences may be criminalized or decriminalized over time or across jurisdictions. In the 
temporal dimension, the change of criminal law over time nécessitâtes legal refonn, while in 
the spatial dimension, the différence in criminal laws between the various countries requires 
international hannonization. The emergence of cybercrime engenders both challenges. 
Analysing the éléments of cybercrime helps to structure the legal System in the new field. 
The process of criminalization and penalization of various cybercrimes must be based on the 
reorganization and reconstruction of traditional criminal law. The incorporation of 
cybercrime not only increases the quantity of clauses, but also enriches the content of 
criminal law; it not only influences the literal provisions, but also helps to update the 
conventional notions; not only does it take into account the criminal “law,” but it also 
considers criminal policy. The general principle of criminal law has been concluded as 
“nullum crimen, nulla poena sine lege.” 16 Nevertheless, at the same time, “[E]ven those laws 
which hâve been written down are best regarded as not unchangeable.” (Aristotle Aristotle, 
cited in Vernant, Jean-Pierre ed., 1995, p. 148) Timely amendment is a prerequisite for a 
penal code to meet the need of social change and for combating crimes. 

As a social phenomenon, crimes change with the development of society. It has 


16 The Latin maxim literally means that “no crime, no penalty without law.” Initially incorporated by 
Paul Johann Anselm Ritter von Feuerbach as part of the Bavarian Code in 1813, the principle has been 
broadly adopted in both national and international laws. Many countries provide for the principle in 
their constitutions. For example, Chapter 1 Section 8 of Constitution of Finland provides the principle 
of legality in criminal cases, saying that “No one shall be found guilty of a criminal offence or be 
sentenced to a punishment on the basis of a deed, which has not been determined punishable by an Act 
at the time of its commission. The penalty imposed for an offence shall not be more severe than that 
provided by an Act at the time of commission of the offence.” (Constitution (731/1999), Translation 
provided by Finland Ministry of Justice). 

Other countries provide it in their criminal laws. For example, Section 1 of Criminal Code of 
Germany provides that “An act may only be punished if its punishability was determined by law 
before the act was committed.” (As promulgated on 13 November 1998. Translation provided by the 
Germany Fédéral Ministry of Justice) International agreements also adopted this principle. For 
example, Article 22 of Rome Statute of the International Criminal Court, 17 July 1998 prescribes that 
“1.A person shall not be criminally responsible under this Statute unless the conduct in question 
constitutes, at the time it takes place, a crime within the jurisdiction of the Court. 2. The définition of a 
crime shall be strictly construed and shall not be extended by analogy. In case of ambiguity, the 
définition shall be interpreted in favour of the person being investigated, prosecuted or convicted... ” 
Article 7 (1) of European Convention on Human Right has a similar provision. 
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previously been recognized that with the advent of ICT, social change brought about by 
technology is capable of occurring with devastating rapidity. Social scientists should make 
efforts to identifÿ the bases of the transformation occurring in the information âge, a 
transformation which is happening faster than ever before (Peters 1971, p. 31). The theme 
considered with in this dissertation is that despite the fact that society is increasingly 
dépendent on information Systems, cybercrime is eroding the underpinning of this society. 
“How to implement appropriate sanctions on cybercrime?” becomes one of the important 
questions society ought to answer. There hâve already been a number of preliminary efforts 
to analyse cybercrime and punishment, though the current achievement are somewhat 
fragmentary. 17 

While ICT is an instrument that people designate to promote social welfare, the 
distinctive nature of cybercrime is social hann. The technology itself, nevertheless, contains 
no value judgment. It can only be used to satisfy révélation of both virtue and vice. Even if 
people deliberately use the technology to promote virtue and to restrain vice, this can hâve 
only a limited function. The purpose of ail laws, particularly criminal law, is to protect 
individual, collective, public, or State interests by using the threat of punishment and by 
executing punishment to make the threat realized. But with cyber offences something more is 
needed. Consequently, the liability mechanism has been deployed as a necessary remedy for 
the abuse and misuse of technology (see especially Chapter X of this thesis). 

At the same time, the vulnerability of infonnation Systems 18 exposes them to potential 
threats firom social actors motivated by different desires. As Bertrand Russell stated that, 
“Life is nothing but a compétition to be the criminal rather than the victim” (Russell 1920, in 
Griffin 2001, p. 215). Due to the potential for harm, cybercrimes and cybercriminals certainly 
concern governments, law enforcement, and international organizations. The liability of 

17 In Chapter V, I shall give the details of cybercrime as a research subject. An alternative proof can be 
acquired through checking library catalogues or online databases, in which thousands of books, 
journal articles, reports, and legislative documents, and cases are deposited. 

ls According to the U. S. Fédéral Standard 1037 C, the term information System has the following 
meanings: “1. A System, whether automated or manual, that comprises people, machines, and/or 
methods organised to collect, process, transmit, and disseminate data that represent user information. 2. 
Any télécommunications and/or computer related equipment or interconnected System or subsystems 
of equipment that is used in the acquisition, storage, manipulation, management, movement, control, 
display, switching, interchange, transmission, or réception of voice and/or data, and includes software, 
firmware, and hardware.” See Fédéral Standard 1037C, MIL-STD-188. 
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cybercrime has become a new subject-matter in criminal law, tort law, and even contract law. 

As Smith, Grabosky and Urbas (2004) pointed out that, (their) previous studies had 
carefully described likely kinds of digital crimes and had furnished many appropriate 
préventive measures to stop crimes of this nature (p. 14). In order for our society to continue 
to flourish, legal certainty should be extended to guarantee that criminal activities committed 
in cyberspace are punished in the physical world. Starting from the accepted premise that 
social science theory can add help design and shape the social process (Coleman 1990), this 
dissertation focuses on the criminalization of offences, the harmonization of jurisdiction, 
international coopération, and intégrative prévention mechanisms. It will review and evaluate 
critical factors confronting the criminal-law System so as to give feasible policy 
recommendations for dealing with cybercrimes more effectively. 

1.2 Scope and structure of the study 

The scope of this study covers four aspects: information, the Internet, cybercrime and 
deterrence. Information provides an extra impetus for the development of society. The 
Internet poses great challenges to the legal System. Cybercrime is the cloud hanging over this 
interconnected infonnation society. Deterrence is an attempt to eliminate the cloud. 

Infonnation has ail along been an increasingly dominant factor in the development 
process of civilization, as human beings sought shortcuts to speed information transmission 
and expand the span of information distribution. The inventions and discoveries of the earlier 
periods, particularly those in the field of the recording, transmission, distribution, transaction, 
consumption, and processing of infonnation, constantly enabled society to develop. Today, 
ail communication industries hâve their mission to satisfy the requirement for overcoming 
obstacles of communication over time and space. With the utilization of electricity, 
information transmission has reached the velocity of light (Cornish 1982, pp. 43-49). During 
the past two centuries, the télécommunications sector has developed rapidly, particularly 
when people hâve introduced innovative communications technology one after another. 

The limit of human beings’ own ability requires us to invent constantly. Various vehicles, 
including cars, trucks, tractors, boats, ships, planes, hâve the capacity of carrying goods and 
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passengers that people cannot carry. Cartridge, jet or laser printers hâve an absolute speed to 
produce printouts faster than any traditional transcribers do. Bullets, guns, tanks, warplanes, 
and warships are more than ever used to damage the enemy’s visible rivalry. The function of 
computers to process information, the function of deposit media to save infonnation, and the 
function of the networks to transmit infonnation ail pose new challenges to traditional 
notions. Through computer Systems, infonnation reaches every corner of the globe and every 
fleld of social production, becoming one of the crucial symbols of contemporary society and 
one of the fundamental bases of human life. 

In addition, scientists hâve connected millions of computers into a global information 
network, which is the Internet. This transfonnation has been brought about by ICT (Division 
of Infonnation 2001, p. 2) (Australia). ICT has much strong power such as compression of 
time and distance, 19 infonnability, relative easiness of access, targetability, and relative low 
cost (Public Management Service, PUMA 1998, pp. 15 and 34). The présent reality is the 
réification of the past expectation. More than two décades ago, Hamrin (1982) anticipated 
that more individuals would be implicated in the management of information than were 
employed in traditional industries and private services combined (p. 66). In fact, the rapid 
development of the information industry proves that the worldwide labour force is moving 
forward in this direction, and the traditional industries hâve fallen, declined, hâve tumed 
themselves into an infonnation industry, or hâve tumed to the services of the information 
industry. More and more actors, including individuals, groups, organizations, corporations, 
political parties, and State agencies are playing survival gaines on this new arena. The 
transformation of this micro social System has turned out to be a powerful force that impels 
the transformation of the whole society. 

The juridical sector is not exempted from this change. The entire legal System has 
undergone a continuous update in the information âge. New legal events demand the 
attention of the législature and judicature. Information Systems are vulnérable to both internai 
and external factors. Critical infrastructure is inevitably confronted with potential abuses 
(Council of Europe, Convention on Cybercrime, Preamble) and attacks (Sofaer and 
co-workers 2000). The tasks of both protecting the legitimate interests and punishing 

19 “Compression of time and the annihilation of space” was referred in Harvey (1989, pp. 293-295). 
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illegitimate activities fall on législation and law enforcement. A perfect legal framework 
(substantive law) and perfect judicial procedures (due process) are both necessary for this 
idéal to be realized. However, the idéal has inevitably suffered from frustration and induced 
critiques. Law and procedure can never be perfect. Even though the appropriate législation 
had been drafted, cybercrime already emerged a decade after the invention of the computer. 
After three décades, cybercrime has become a noteworthy and costly act, described as a 
“multifaceted phenomenon”, which comprises illégal conducts involving hardware, software, 
and data (Parker 1990, p. 181). The topics of cybercrimes and cybercriminals attract the 
attention of both individual and organizational players, and are addressed in local, national 
and international forums. Although the discussion in this dissertation has been more or less 
linked to the criminological théories mentioned at the beginning of this chapter, the 
exploration, description and explanation developed in the following chapters are not 
presented in a way to coincide deliberately with these theoretical aspects. Rather, the contents 
are arranged in a way to reflect the intrinsic structure of the thinking hitherto established in 
this spécifie order. 

In Chapter 2, infonnation is classified according to its value into fïve categories, 
including infonnation with positive value, value-neutral information, valueless information, 
information with négative value, and information the value of which is disputable. The 
Chapter further analyses the interaction between information and criminal law, particularly 
the necessity for criminal-law reform in the infonnation âge. 

The purpose of Chapter 3 is to introduce the social-technological background of the 
emergence of cybercrime and the necessity for a legal response. The pervasiveness of 
information and communications Systems brings about a legal gap in regulating the new 
crimes and new forms of existing crimes. There is also the necessity for extending the objects 
that the criminal law should protect. The rapid advancement of technology and the inertia of 
criminal law form a sharp contrast. The multiple rôles of computer Systems in crime, and the 
decentralization of the Internet make it more complicated to combat cybercrime effectively 
through any single measure. 

To address the challenges posed to criminal law by information Systems, it is necessary 
to clarifÿ how the phenomenon stands from the legal viewpoint. Chapter 4 concentrâtes on 
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the phenomenology and typology of cybercrime. The dissertation proposes a unified 
définition in a broad sense in order to reach a high degree of international consensus. In 
addition, as a development of a previous classification method, the chapter divides 
cybercrimes into seven categories according to the different rôles that information Systems 
play: crime in which information Systems are used as media, target, tool, route, place, means, 
and crime in which information Systems are used in préparation for further offences. 

Chapter 5 is set out on the understanding of cybercrime as a research topic. The 
phenomenon has attracted increasing attention in scientific research: as a topic for criminal 
science literature, a university course, a subject for a degree thesis, a theme of 
multidisciplinary research, and a professional speciality. The research methods of this topic 
rely on information Systems. Literature research, court decisions, and international 
comparison become more accessible with the accumulation of online infonnation. 
Experiments are also available in some laboratories. 

Chapter 6 looks at the characteristics and motives of cybercriminals. With the increase 
of Internet users and infonnation-related activities, the potential cybercriminals acquire more 
opportunities to launch attacks of different scales and from different motives. This chapter 
identifies more than twenty types of motive. The possibility of moving traditional crimes into 
cyberspace has alerted law enforcement to fight against existing cybercrime and to préparé 
for emerging threats. 

Chapter 7 analyses the primary characteristics of cybercrime with spécial reference to its 
détection and deterrence. The characteristics of the perpetrators, the subjective situation, the 
typical victims, time and space, technological involvement, complexity, costs and losses, 
détection and investigation, conflicts of jurisdiction, and rampancy of the cybercriminal 
phenomenon will be examined. 

In Chapter 8, the dissertation reviews the historical development of cybercrime and legal 
countenneasures. The chapter divides the process into four stages and concludes that 
cybercriminal phenomena hâve developed almost synchronously with ICT. Cybercrimes are 
in a process of accelerating development and are becoming gradually routinized. While the 
electronic divide thus results in cybercrime divide. The basic conclusion is that criminal 
resources décidé the amount of crime, while judicial resources décidé the deterrence. When 
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the balance is reached between criminal resources and judicial resources in the long term, the 
criminal phenomena will be saturated at an equilibrium point. 

Chapter 9 analyses criminalization through an international comparative study. Many 
countries hâve implemented législation to increase punishment and thereby to reduce 
cybercrime. Different organizations hâve also implemented international countermeasures, 
though there remains the necessity for adequacy of législation on cybercrime. Either the old 
law or the new law, either the domestic législation or the international harmonization, should 
be used to meet the social need and eliminate the legal gap. 

Chapter 10 studies the various forms of liabilities of cybercrime. Criminal sanctions are 
necessary but are currently neither in being nor will be suffïcient alone. Civil remedies can be 
complementary to the criminal sanctions. The chapter also analyses liabilities based on 
different subjects, legal bases, the psychological status of the perpetrator, functions of the 
liabilities, and so on. The chapter concludes that a liability mechanism of broad coverage is 
necessary to combat cybercrime. 

Chapter 11 focuses on the theme of cybercriminal jurisdiction. Because of wide 
distribution of cybercriminals and the lack of legal consensus, cyberjurisdiction is becoming 
a problem that législation and law enforcement must deal with. It is necessary to create 
workable rules that bridge the local, national, and international boundaries. This chapter 
reviews the traditional basis of criminal jurisdiction and some new théories conceming the 
rebuilding of a basis for criminal jurisdiction. The chapter concludes with the idea of a 
liability-based jurisdiction and some focal points of cybercriminal jurisdiction. 

Chapter 12 reviews the international impetus of criminal-law initiatives in combating 
cybercrime. This chapter classifies the actions of international harmonization into 
professional, régional, multinational and global actions, summarizes the major concerns 
arising from these actions, and évaluâtes the influence of the Convention on Cybercrime at 
the national and international levels of legal countermeasures. The chapter also points out the 
limitations of the previous actions and anticipâtes the UN playing a more important rôle. 

Finally, Chapter 13 concludes the whole dissertation by emphasizing that cybercrimes 
are different from traditional crimes and thus pose new challenges to the legal Systems, and 
that criminal law plays a necessary but limited rôle in combating cybercrime. With the 
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routinization of the phenomenon of cybercrime, criminal-law reform will slow down. Overall, 
solutions should be found from the impacts of vulnerabilities and motives. The vulnerabilities 
should be eliminated by technological means, while the motives should be eliminated by 
legal instruments. 

In sum, the issue of motivated criminals is mainly dealt with in Chapters 3, 4, 6 and 7; 
exposure of victims in Chapters 3 and 4; and absence of guardianship in Chapters 2, 3, 7, 9, 
10, 11 and 12. Two aspects are apparent here: First, the factors explored in Chapter 3 hâve 
efifects by ail the three aspects, that is, they clarify the motives of the criminals, expose the 
vulnerabilities of the potential victims, and at the same time reveal an absence of 
guardianship. The factors explored in Chapters 3 and 4 serve as investigating tools to clarify 
both the motives of criminals and exposure of victims. The factors explored in Chapter 7 
serve to elucidate both the motives of criminals and absence of guardianship. It is évident in 
cybercrime that the three aspects of the routine-activity theory are intertwined together to 
form an integrated entity. 

Second, lack of guardianship and efforts for deterrence are always hand-in-hand. Lack of 
guardianship nécessitâtes efforts for deterrence; inefficiency or ineffectiveness of deterrence 
demonstrate a further lack of guardianship; and so forth. While the routine-activity theory was 
established as an idéal model, my attempts here give more considération to the parallel 
development of increased cybercrime and improved deterrence. 

In a dynamic process of crime and deterrence, the three aspects in the idéal theory do, 
indeed, interact with each other. Through the focus on interaction we can draw idéal theory 
into the field of cybercrime inquiry, and endow it with power. 

It is necessary to emphasize that this dissertation is focused more on the cybercriminal 
phenomena themselves, that is, to explore, describe and explain them. While quite a few 
space is left for legal countermeasures, answers to questions “What has been done?” and 
“What has to be done?” are not deeply dealt with. They serve more to assist fulfilment of the 
overall objective of the dissertation than as a target of critique, which deserves a specialized 
discourse, particularly one relating to subséquent judicial practice. 
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CHAPTER 2. LEGAL ROLES OE INFORMATION SYSTEMS 


2.1 Introduction 

After the introductory text of this chapter, I am now going on to discuss the 
subject-matter in detail. The following chapter will deal with the conception and 
classification of information in the domain of law, and the challenge it poses to the traditional 
legal System. 

When we explore society, we begin with observing human beings ourselves. Human 
beings hâve a détermination of orientation to survive and to front the uncertain, unstable and 
uncontrollable environments, both physical and social environments, whether natural, 
constructed or cyber (a theme developed in Chapter 1, Section 1.1 based on Coleman 1990). 
It is this orientation to survive the uncertainty and to know the unknown that propels human 
beings to reshape the already shaped, reconstruct the already constructed, and reorganize the 
already organized. 

While the discussion here will not be reduced to philosophical assertion, I accept that 
change is the etemal attribute of society. 20 Accumulation of information contributes greatly 
to social transformation. Digital information has become the décisive innovative factor in 
économie development and the leading resource in contemporary civilization (Molitor 1982, 
p. 84; Fisher 1984, p. 1; Rabin and Jackowski (eds) 1988; Daler and co-workers 1989, p. 13). 
Just as good land is a décisive factor for the agrarian economy, capital for the industrial 
economy, existing knowledge is a décisive factor for the information economy (Stonier 1983, 
p. 21). The relationship between these factors is not simply parallel, but progressive. In 
contrast to land, capital and infonnation are more closely linked to human interactions. In 

20 It has long been recognized that both nature and society are changing. What Heracleitus said “One 
cannot step twice into the same river,” (Heracleitus 1979, p. 168) can be understood broadly as 
récognition of a changing world. The présent day idea of change is accepted as the inherited nature of 
existence. 
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contrast to land and capital, information is more closely linked to interactions of human 
intelligence. To say their relationship is in a progressive style is to say that information is the 
newer and higher level of achievements of human efforts (See Table 1). The implication of 
the recent information révolution lies in the fact that it is designed to eliminate the shortage 
of knowledge by processing data and information. 


Table 1 Land, Capital and Knowledge 


Factors 

Land 

Capital 

Knowledge 

Forms of 

the 

Agrarian 

Industry 

Infonnation economy 

economy 





Forms 

of 

Non-interaction 

Human-human 

Human-machine-human 

interaction 



interaction 

interaction 


Infonnation is therefore the enormous wealth of the social progress, which has been 
considered the fourth resource (UNCJIN 1999, Paragraph 85), alongside natural resources, 
property resources, and human resources. In contrast to other resources, infonnation can be 
regarded as the only resource that can really be shared (Stonier 1983, p. 19). Fisher used a 
metaphorical statement describing infonnation as power, “power to manage, power to 
manipulate, power to control” (1984, p. 1). Tapscott, Ticoll and Lowy (2000) further 
discussed the conception of digital capital in terms of business, stating that digital capital 
emerged froni the incorporation of three types of knowledge assets: human capital, customer 
capital, and structural capital (p. 5). With the network, people could “gain human capital 
without owning it; customer capital for complex mutual relationships; and structural capital 
that builds wealth through new business models.” (ibid.) 

Other scholars further put infonnation into a dynamic wealth-creating process, regarding 
information (particularly knowledge) a “key wealth-creating assets” (Porter and Read 1998, p. 
26) apparently in a dynamic productive and reproductive process. Information processing is 
thus a process of promoting social productivity. 

Unquestionably, the traditional resources hâve been seen as incomparable with the 
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capacity of information, which can bring about enormous productivity and unprecedented 
social transformation. Information and related technology has created a new epoch, a new 
society, and a new way of thinking for the modem human beings. In our reading of traditional 
society, one thing stands out as fundamentally different firom the infonnation society, which 
is information dépendent, information abundant, and information shared. Bjorn-Anderson 
and co-workers (1982) correctly predicted that the infonnation society would be 
characterized by the remarkable increase of infonnation flow, the contraction of temporal and 
spatial constraints, the increasing dependence of social life on infonnation Systems, and the 
synchronous application of new technology on society (pp. xi-xii). It is apparent that people 
consider information as being of positive value and grant potential power in its conceptual 
category. 

People usually distinguish infonnation from both data and knowledge. According to 
Stonier (1983), data is a sériés of unconnected facts and observations, likely to be changed to 
information through refining or organizing activities, while knowledge is organized form of 
information, providing the basis for insight and judgments (p. 19) Detailed relations between 
the terms can be illustrated as in Figures 2 and 3. On the other hand, information at one level 
may merely be data at another level (ibid). Finally, there can never be a clear limit between 
these terms. They are usually used interchangeably. For example, knowledge is the highest 
level of data or infonnation, but people do not talk about knowledge security instead of data 
security and information security. In addition, information Systems are actually “data 
Systems”, 21 but the favourite term in various disciplines is still “information Systems”. In this 
study, the word “infonnation” is priority choice where these three words can be used 
interchangeably. 


21 See Johnson (1970) stating that “Data System is used here to designate the artefact that consists of a 
digital computer, a control program, and an accessible library of programs and data.” (p. viii). 
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Data 



A proportion of data is information, from which a proportion is drawn as knowledge. 

Figure 2 Relations between Data, Information and Knowledge 



Data processing is achieved through technological development. Information Systems 
are a part of critical infrastructure. Knowledge management is an element of productivity. 
The phrases in brackets dénoté the alternative usage of the terms when they are used 
interchangeably. 

Figure 3 Social Rôles of Data, Information and Knowledge 


67 



In sum, the strong and the wealthy in the agricultural society strive for more and better 
land; the strong and the wealthy in the industrial society strive for more and better capital; 
and the strong and the wealthy in the information society strive for more and better 
information. 

Nevertheless, the term “information” is theoretically used as a value-neutral tenn. From 
the viewpoint of law, the term “information” stands for “data, text, images, sounds, mask 
works, or computer programmes”, including the process of collecting and compiling them. 22 
Important éléments involved in defining information in the modem sense include: 

Infonnation is electronized. The current processing form of information is characterized 
by mobilization through electricity, fastest known vehicle. 

Infonnation is digitalized. The current information is processed in the form of digits, “0” 
and “1”. 

Infonnation is computerized. Information is created, deposited, processed and 
transmitted by the assistance of computer, a powerful “information machine” (Konig 1967, p. 
1). 

Infonnation is automatized. The process in which infonnation is created, deposited, 
processed and transmitted is a kind of human-machine interaction. There is no absolute 
automitization. 

Infonnation is networked. Information is transmitted through the networks. It is 
electricity, digits, computer and automitization that constitute the basis of the networks. 

Infonnation is modernized. It is not in a process of modernization, but in a process from 
modem to post-modern. It is modernized thus transformed. The change breaks the 
equilibrium of the conventional control and organization, motivating somebody to harvest 
from déviant actions, exposing somebody else to potential threats, and reducing the 
effectiveness of any safeguard. 

Infonnation is evaluated. The value of information is recognized, accepted and 
respected. 

Lacking any of these éléments, the object can hardly be regarded as infonnation. The 
22 Unifonn Computer Infonnation Transactions Act (UCITA), Section 102 (35). 
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modem définition of information therefore inevitably contains different factors from the 
traditional meaning of this tenn. Many people nonetheless misunderstand the exact meaning 
of infonnation and consider that law has regulated infonnation for several centuries or 
millenniums. This suggestion ignores the différence between information in the traditional 
sense and that in the modem sense. While the traditional fonn of information is heavily 
substance dépendent, the modem information is processed by digital technique. The présent 
information is practically transfonned into digital information, regardless of whether it ever 
existed in the pre-computer era. Particularly, on account of the spécifie fonn of existence, a 
copy of information is not necessarily different from the original information in content, 
quality and medium. Under such circumstances, the tenn “infonnation” can precisely cover a 
copy of information. 23 In the network environment, infonnation, its copies, and the copies’ 
different digits may be transmitted along the cable, fibre, or wireless networks without the 
spatiotemporal limits. 

Considering the different rôles of different categories of information in the legal System, 
it is necessary to classify information according to its value from the standpoint of law. Law 
does not provide equal protection for ail kinds of infonnation. On the contrary, law merely 
encourages the processing of infonnation with a positive value, but discourages the 
Processing of infonnation with a négative value. Although people deem information Systems 
to be part of a critical infrastructure, and we transmit various kinds of information through 
the same information Systems, the legal nature of these kinds of information should be 
differentiated. 


2.2 Classification of information in the legal sense 

Social inquiry usually starts from conceptualization (Babbie, 1995). Having talked about 
the conception of infonnation, and not necessarily repeating accepted définitions, this section 
will give a sketch of classification. 


ibid, Section 102 (10). 
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The legal value of information has long been recognized. 24 The legal effect, validity or 
enforceability of information should not be rejected simply on the ground that it is in a form 
different from that seen in traditional documents. 25 As in United States v. Adajan case the 
court ruled that computers could be at the same time storerooms of private information that 
must be guarded, or that of criminal proofs that must be identified. 26 

Previously, people were inclined to dichotomize information into legitimate and 
illegitimate, for instance, Sterling (1994). The nature and content of information are far 
broader than merely being legitimate and illegitimate. The value of information can be 
regarded as a criterion for a typology. On this terrain, information can be sorted into fïve 
categories according to the value it has and by whom it is held: information with positive 
value, value-neutral infonnation, valueless information, information with négative value, and 
information with disputable value in different communities. 

The first category of information, infonnation with positive value has the capacity to 
promote social welfare. The positive value of this category of information dépends on the 
content of the information. If the offenders access to or destroy such information without 
authorization, the value of that infonnation would be abused or exterminated. Loss of 
information with positive value, or loss of value of such information, either due to breach of 
its confidentiality, integrity, or availability, diminishes the efficiency of the information 
owner or, in turn, promûtes the efficiency of the opponent. Offences involving infringement 
of information with positive value, infringe the rights and interests of the infonnation owners. 
The related acts include unauthorized acquisition, modification of, destruction of, and 
tampering with infonnation, and interférence with infonnation transmission. In particular, 
offences related to the ownership of infonnation may possibly infringe the rights to 
information, such as appropriation, unauthorized use, obtaining income, and disposition. To 
copy, retrieve, deposit, publish, duplicate, utilize, promulgate, transmit, conceal, encrypt, 
decrypt, transfer, sell, etc., without authorization or legal pennission, are ail conducts that can 

24 See UN Recommendation on the Legal Value of Computer Records, adopted by the Commission at 
18 th session 1985. 

25 Article 5, Model Law on Electronic Commerce of the United Nations Commission on International 
Trade Law, Annex of General Assembly Resolution A/RES/51/162. 

26 United States v. Christopher Lee Adjani; Jana Reinhold, No. 05-50092 D. C. No. 
CR-04-00199-TJH-01 OPINION, 13 January 2006. 
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breach the ownership of information. 

The second category of information, value-neutral information indicates that the value 
of infonnation cannot be classified into positive or négative. Rather, it can be utilized as 
either positive infonnation or négative information, or used as positive information or 
négative information. This kind of information cannot either automatically advance social 
prosperity, nor necessarily impair social interests. This kind of infonnation can be either used 
or misused, or simply exists in itself. For example, collections of e-mail addresses can be 
used in sending advertisements of opt-out electronic marketing, or fabricating an advance-fee 
scheme. However, these addresses are value-neutral, as the user naines and passwords are, 
too. This category of infonnation is value-neutral from the standpoint that its content cannot 
be judged to be positive or négative as such. 

The third category of infonnation is valueless information. Some infonnation has no 
value, for example, unsolicited commercial e-mail (UCE) or unsolicited bulk e-mail (UBE) 
without information of either a positive or négative value. The distinction between 
value-neutral information and valueless information lies in whether the value-neutral 
information does not induce a question of value judgment, and people cannot evaluate it as 
favourable or unfavourable; while valueless infonnation induces value judgment, and people 
can evaluate it as neither favourably, nor unfavourably, but ordinarily as futile. In contrast to 
value-neutral infonnation, valueless information can be used neither to promote social 
welfare, nor to dégradé the social interests. This category of infonnation is valueless by 
virtue of the fact that its content is valueless. However, the process may impair the normal 
order of the cyberspace by disseminating and transfening such information through 
information Systems with malicious intent. The transmission of the valueless information 
exploits the bandwidth, 27 fonning a worthless data flux and wasting the receiver’s time to 
deal with it. If the fact is of high ambiguity, the users hâve to spend time to browse around 
the information; even if the matter is of high certainty, the users also hâve to spend time 
removing the infonnation. Even though each user wastes merely a few seconds or minutes, 
the time wasted by millions or even billions of users will be a substantive quantity. The 

27 The bandwidth of a transmission channel is “a measure of the information-carrying capacity of the 
channel.” Daintith (2004), p. 38. 
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process will virtually diminish the effîciency and increase the expenditure. 

The fourth category of information, information with négative value indicates that the 
appearance, existence, and dissémination of information are detrimental to the stability of the 
State, public order, and individuals. It does not exist without the intervention of human factors. 
Sonie are created with malicious intent, for instance, a computer virus; 28 some are created 
from a contradiction within one’s value concept, in which he or she regards it as legal and 
bénéficiai to deal with such information as adolescent pornography, hâte speech, etc.; some 
information is falsified infonnation, fabricated with the purpose for defrauding and obtaining 
property or other benefits, or for disparaging, defaming, blaspheming, etc. To reproduce, sell, 
promulgate, publicize such information are ail measures that cause monetary losses or other 
damage to others. 

The introduction of négative information into infonnation Systems poses a sériés of risks 
that may lead to perilous and erroneous decisions, and cause impairment, suicide, and 
calamity. The risk of these threats nécessitâtes an increasingly higher level of cybersecurity 
guaranteed by diverse spécifie services, with increased expenses and personnel. The entire 
society, from individuals, organizations to govemments hâve to deal with the misinfonnation, 
manipulation of public opinion, and onslaughts against the social order and interests. 

It is necessary to note that infonnation with négative value can be converted into 
information with positive value once that information is recorded and stored by judicial 
agencies as evidence to hold the fabricators and disseminators liable. This does not indicate 
that the value of information changes, rather, that the information is used to prove the 
existence of the actus reus by its spécifie négative value. It is necessary for success in the 
prosecution of crimes related to information with négative value to seize information as 
evidence. The application of evidence rules should not pose any obstacles for the 
admissibility of infonnation as evidence. 29 It should be granted because of its evidential 
weight. 30 Therefore, infonnation should be differentiated in both substantive criminal law 

2S A computer “virus is a programme that is attached to or inserted into another programme...The 
virus may or may not do other things.” (Sadowsky and co-workers 2003, p. 47). In practice, viruses 
usually cause damages to the computer System. 

29 Article 9.1, Model Law on Electronic Commerce of the United Nations Commission on 
International Trade Law, Annex of General Assembly Resolution A/RES/51/162. 

30 ibid., Article 9.2. 
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and criminal procédural law. 

Besides the above four categories, there is a fifth category of information the value of 
which is disputable in the legal sense. That is to say, the criteria for evaluating the 
information are different in different countries. For instance, in some countries adult 
pornography is protected as free speech by the constitution and other laws, while in other 
countries its création, production, duplication, publication, transaction, and dissémination are 
strictly forbidden. Furthermore, infonnation can constitute a kind of political propaganda, 
which is also granted a different legal position in different countries, some having a high 
degree of free speech, and others having tight laws of political libel, and so forth. 

Although information can be distinguished according to subjective judgment, it does not 
in itself represent virtue or vice. The pervasiveness of information does not constantly push 
forward social development and facilitate the maintenance of the legal order. Through 
technological supremacy, ail kinds of information play certain rôles, exert their influence, and 
gain markets. They are ail regulated, intercepted, and monitored. Similarly, they ail bear the 
risk of unauthorized access and destruction. In addition, it is possible to obstruct positive 
information by législation and court rulings, while négative information may be protected 
erroneously. Accordingly, information products and services, sources and destinations, 
storage and flux, domestic and international information, and public and credential 
information bring about the complicated process of value judgment. In this dissertation, 
except when otherwise mentioned, the term “information” is used in a positive sense. 

The Ml power of information has been realized through ICT, which has a broad impact 
on social lives, including maintaining the common traditions through improving the 
accessibility of infonnation about religious practices; keeping cultural continuity through 
access to more information; enabling govemments, commercial businesses, news and media 
organizations, as well as educational organizations to perforai their Mictions well; and 
increasing collective activities and interests through an improved work process and social 
interaction (Cnaan and Parsloe 1989; Committee to Study the Impact of Info, National 
Research Council Commission of the U. S. 1994). 

Simultaneously, due to the accelerated accumulation of infonnation, the management of 
information poses a great challenge to the public and private sectors (Daler 1989, p. 13). Both 
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internai and external threats may cause unexpected loss to individuals or organizations. The 
resources invested on information management hâve to be increased. In turn, infonnation 
Systems will further propel the advancement of the society. 


2.3 Information and the legal gap 

Digital information is a novel product of technological progress aimed at promoting 
social welfare through improving productivity. Information and other products of information 
technology, however, do not always play a positive rôle as people sometimes expect. In fact, 
many human expectations are left vacant in social reality. Society never previously got rid of 
unforeseeable trouble for information of a positive value and that of a négative value was not 
easily distinguishable or fîltcrable before information Systems came into being. Nowadays, 
both the infonnation itself and the relevant technology hâve a significance within the legal 
framework, because they should be either protected or prevented by law. Legal activities can 
involve infonnation and ICT in different ways. The conventional legal notion is to be 
innovated to accommodate the inévitable rôle of information. The existing legal coverage 
should be extended to facilitate the protection or prévention of information processing and 
information abuse. Furthennore, co-operative preparedness and jurisdictional adequacy are 
required for promoting the effectiveness of law enforcement. 

Information and communications technology takes the traditional society into a brand 
new stage that people call the infonnation âge. The existence and development of the 
information society requires a feasible social environment. The primary tasks that the legal 
framework bears are to provide legal assurance for the healthy and orderly development of 
information and télécommunications, and electronic and mobile commerce. Law does so 
through facilitating growth and eliminating obstacles. The infonnation society is 
accompanied by various concerns about data security and privacy protection. The prevalence 
of insecurity and infringement threatens the whole environment of the new technology, new 
économies and new welfare. Such insecurity and infringement lead to the création of 
défensive and remédiai legal instruments against cybercrime, composed of both substantive 
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and procédural provisions, and of both domestic and international legal adequacy. The 
complété legal structure of the infonnation society can be illustrated as the following: 


Table 2 Facilitative Law, Protective Law and Remédiai Law 


Categories 

Facilitative Law 

Protective Law 

Remédiai Law 

Functions 

Facilitating growth, 

eliminating 

obstacles 

Avoiding insecurity, 

preventing 

infringement 

Domestic 

criminalization, and 

international 

hannonization 

Coordinated sectors 

International forum, 

Domestic forum 

Public sector, private 

sector 

Public sector, private 

sector 


The topic of this dissertation contains no more space for facilitative law. The following 
sections are devoted to analysing the legal gaps accompanied by the prolifération of 
information Systems. 


2.3.1 The lag of a legal notion 

Many scholars regard infonnation as the third form of protective object in criminal law, 
alongside person and property. Accordingly, the criminal-law theory has been adjusted to 
contain the new protective object. Some others, however, insist that information is not the 
third protective object in criminal law; rather, they consider it as belonging to the category of 
property. 31 They hâve criticized both the claim that infonnation is the third protective object 
and the claim that information is not a protective object covered by criminal law. 

Conventionally, “information” in the fonn of digits was not previously covered and thus 
not protected explicitly by criminal law. Just as traditional économie doctrines maintained 
that only land and manufacturing rather than the service sector produced real wealth (Stonier 
1983, p. 25), traditional legal théories maintained that only wealth represented or produced 

31 Many of such arguments and discussion can be found in articles published in the 1980s, for example, 
BloomBecker (1981), pp. 16-17. 


75 




by land and manufacturing deserved legal protection. However, once the requirement to 
protect information emerges, conventional concept has to meet the needs of social 
development. Therefore, to say that information was not and should not be protected by 
criminal law is outdated. In fact, the majority of scholars and législatures hâve not accepted 
that it should be protected. 

Infonnation has been protected by criminal law in two ways. While there are people 
suggesting that law should not protect information, some others assert that information can be 
protected by a means équivalent to the protection of property. That is to say, information 
should be categorized as being in the same domain as property. People consider expanding 
the arm of criminal law to information just as they did to electricity. 

On the other hand, from ancient to modem times, criminal law has in effect been 
handling crimes related to information in different forms other than the electronic one, such 
as libel, perjury, forgery, blasphemy, hâte speech, copyright, trademark, patent, and so forth. 
In practice, information does broadly cover those spécifie traditional fonns, such as oral, 
written, and printed forms, and more recently the fonns stored, and transmitted by electronic, 
magnetic, and optical caniers, including the téléphoné, facsimile, radio, télévision, satellite, 
and nowadays computers and networks. When people face digitally computerized 
information, they pay a lot of attention to the existence of infonnation in traditional forms, 
and thus give new life to traditional information crimes. Our general notion should be 
changed in order to adjust to the new ways of “thinking, writing, arguing, and valuing” in the 
information society (Lanham 1993, p. 229). The semantic practices of the latter society are to 
label everything with a mark of “information” or to refer to its physical vessel “the 
computer” or to “the network.” 

It is an issue of “concept innovation” rather than criminal-law refonn to recognize this 
point, but this concept innovation is necessary during criminal-law refonn. Many crimes can 
be reconsidered in the light of the prevalence of the concept of information. With 
electronization, computerization, digitalization, automatization, and networking, these crimes 
become more apparently characterized as involving information. This justifies a wide 
expansion of punishment for the traditional offences involving information or information 
Systems. Anyway, criminal law cannot demand a further expansion except through our 


76 



understanding of the nature of these crimes. The social and technological developments hâve 
been impacting on criminal law. 


2.3.2 The legislative gap 

Information is an emerging object protected by laws designed to maintain social order 
and protecting social benefits. The conventional penal code has been designed to address 
crimes involving “tangible and visible objects” (UNCJIN 1999, Paragraph 84). The 
increasingly higher value of infonnation poses unprecedented legal challenges, demanding 
new legal responses (ibid). Information has a value for spécifie owners and users. 
Cybercrimes often involve the illégal obtaining or destruction of infonnation. Because 
information, programmes, databases, computer services or computer time, are intangible and 
invisible, conventionally the law has not recognized what to do regarding them and has 
difficulty in providing even the définitions essential to defend this type of property involved 
(BloomBecker 1983, p. 11). Because of the lack of a clear définition of information as a 
valuable interest, the existing law does not easily conduce to successful prosecution. What is 
needed is that the existing laws should be adjusted to guard the abstract “information” itself 
rather than merely the computers in which the information is generated, the media in which 
the infonnation résides, the cables by which the information is transmitted, or the Central 
Processing Units (CPUs) where the infonnation is processed. 

The sphere to be covered by the new laws includes the use of ICT to make existing 
crimes more perceptible, to enable the inclusion of new forms of existing crimes, and crimes 
that specifically attack information Systems (European Information Society Group, EURIM 
2002). Some countries hâve taken action to protect information as property in the traditional 
sense. On the other hand, some other countries exclude the concept of information from 
traditional crimes. Consequently, a noteworthy doctrine in criminal law rejects the 
independent position of infonnation as one of the protective objects, which were 
conventionally confined to human being and property. 

On the issue of infonnation as property, there hâve been endeavours to adopt burglary 
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law to acts of illégal access in which the cyberspace is supposed to be the équivalent of a 
domicile in genuine physical space. 32 Nevertheless, in this endeavour, people ignore the 
distinction between the threats of the two offences. What is endangered in burglary is not 
what is endangered in illégal access. In burglary, what is directly endangered is the security 
of life and property. In illégal access, what directly endangered is the security of information. 
Infonnation is not the équivalent of life and property, though it is likely to be indirectly 
pertinent to life, and can generate benefits or cause losses, or measured by a definite amount 
of money. The offences of illégal access, nonetheless, belong to the activities infringing the 
security of information, but not the right or security of life or property. 

By using the tenus traditionally used to indicate the misconduct in traditional offences, 
the offences against information seem to bear a similarity to traditional offences. Yet many 
people still doubt how a pair of hands can hold a piece of digital information. Strangely, we 
can frequently take notice of a question as “Can infonnation practically be stolen?” The 
genuine uncertainty behind this question is “does information really exist in material form?” 
In addition, the intrinsic meaning potentially ignores the entity of digital information before 
human organs can perceive it. They accept only information printed on paper, shown on a 
screen, spoken in a backroom, transferred into a smell, or into an impression in any other 
form. Nevertheless, it is significant to note that the fact of obtaining infonnation includes a 
pure perception of the content of the material. It is not necessary for the information to be 
physically moved or copied. For instance, the U. S. law criminalizes access to a computer 
without suffïcient authority and thereby getting financial information, or to any information 
controlled by the govemment, and access to any confîdential information where interstate or 
overseas business is involved in the criminal act. 33 In many countries, the law further details 
the act of “obtaining data” by different tenus, such as copy, output, and theft. 

Digital information is not comparable to traditional property, and thus spécifie legal 
provision is required to protect it. However, it is undeniable that information is often related 

32 For example, entering the computer facility with the intent, by whatever means, of discovering 
another’s account number for purposes of stealing computer time constitutes burglary under California 
law and will be prosecuted. See Bruin OnLine (BOL), Information for New Users, 2004. Retrieved 15 
March 2007, from https://www.bol.ucla.edu/cgi-ssl/accounts/newuser 

33 18U.S.C. § 1030 (a) (2). 
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to property, or even health and life. The protection of infonnation will surely facilitate the 
protection of property, health and life. In different countries, punishments for offences against 
property and person involving infonnation hâve different starting-points. Some countries 
directly apply traditional law to these offences, such as the Penal Law of China. 34 The 
Articles 285 and 286 create several new offences in respect of information or information 
Systems. And another article, Article 287, provides for the application of separate provisions 
in the Penal Law to penalize traditional offences, such as financial firaud, theft, embezzlement, 
misappropriation of public funds and theft of State secrets, and would now cover computer 
information Systems, other than in respect of illégal intrusion and destruction. The Article 
indicates that ail the offences that can possibly involve computer information Systems are to 
be punished. Some other countries merely apply the law to acts involving information, as the 
law in the U. S. 35 The 18 U.S.C. § 1030 créâtes several new offences targeted at information 
and information Systems, and expands several traditional offences to acts involving 
information and information Systems. However, the default doctrine is that the offences 
which possibly involve information and information Systems, but are not criminalized 
explicitly by law, would not be punished. 

Nevertheless, criminal law is also confronted with some other gaps brought by the rise 
of computerized information, specifically, the sphere of illégal access to and illégal 
interférence with information and information Systems. The Internet has a universal impact 
on the ways by which people acquire and transfer information. The opportunities for 
cybercrime are correspondingly increasing with the extensive access to computers and the 
Internet. To protect against cybercrime, effective actions at the local, national, and global 
levels can be taken (Sofaer and co-workers 2000). Nevertheless, the overall contemporary 
legislative situation is unsatisfactory: not ail juridictions are covered by laws criminalizing 
cybercrimes; not ail législatures are synchronous with the development of technology and the 
abuse of it (Gelbstein and Kamal 2002, p. 3); and nor can people update their conventional 
notions ail the time. 


See Articles 285-287 of Penal Law of China, 1997. 
See 18 U.S.C. § 1030. 
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2.3.3 The jurisdictional gap 


The challenge to the contemporary legal System of digitalized information and its 
pertinent technology requires that countries with no law regulating the new object should 
enact laws, and that countries with such law should harmonize their laws. The starting-point 
of this harmonization and coopération is the création of coordinated définitions of 
information and information Systems. Some countries provide définitions of information and 
information Systems in their criminal laws, but there exist substantial différences, though in 
the primary aspects they are similar. In addition, the gap between the existing laws of 
different juridictions produces a safe haven 36 for the perpetrators of many kinds of offences 
involving information and information Systems. This situation nécessitâtes an extended 
discussion in Chapters il and 12, dealing separately with trans-border jurisdiction and 
international harmonization. 


2.4 Conclusion 


Being informed is not necessarily bénéficiai. Informed by useful infonnation, people 
can better compete in the social life. Informed by useless infonnation, nothing better or worse 
will happen than a waste of time. Informed by harmful information, people would possibly 
weaken their own compétitive force. Presently, ail kinds of information are transmitted 
through the same information Systems. Interférence with transmission of useful information 
causes people to be less informed. Interférence with transmission of harmful information 


36 The term “haven” is widely used by scholars or mass media to dénoté a country where there is no 
effective législation or law enforcement for combating cybercrime, on academie materials, for 
example, McConnell International (2000), etc. News report, for example, William J. Kole, Romania 
becoming a haven for cybercrime, 17 October 2003, Associated Press. Retrieved 15 March 2007, from 
http://www.chron.com/disp/story.mpl/tech/2163754.html; The Nigérian Village Square, Nigeria: 
Haven for Terrorist Internet Communication? 4 August 2004. Retrieved 15 March 2007, from 
http://www.nigeriavillagesquarel.eom/Articles/oyesanya/2004/08/nigeria-haven-for-terrorist-intemet.h 
tml. The terminology “haven for cybercriminals” is rather offensive to those countries referred to or 
implied. 
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-and even useless infonnation- also causes waste in identifying the value of infonnation. 
Cybercrime can lead to both of these situations. With the introduction of information and 
information Systems into society, protection and prévention become the impérative tasks that 
jurisprudence, législation, and law enforcement are confronted with. There has not been 
adéquate preparedness to respond to cybercrime. The process of récognition and acceptance 
requires much time. The impérative requirement is for people to be well informed about the 
loopholes the legal System has and how they can be altered. 

After clarifying in this chapter the potential change information Systems can take to the 
legal System, particularly towards criminal law, the dissertation will begin to deal in the next 
chapter with the new criminal phenomena on the infonnation networks, starting from a 
discussion about the exposure of the vulnerabilities of the networks to potential criminal 
activities. 
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CHAPTER 3. VULNERABILITIES IN INFORMATION SYSTEMS 


3.1 A process of cyberization 37 

Society dépends on the environment. However, the extent of the dependence changes 
over time. The general tendency is that societies in the newer stages are less dépendent than 
the societies in the older stages. It is obvious, for example, that different environmental 
factors play different rôles in the economy. 

The agricultural economy has been cultivated by biological power, the industrial 
economy mobilized by mechanical power, and the information economy facilitated by 
information power. From the agricultural economy through the industrial economy to the 
information economy, the rôles of natural factors are becoming less and less significant. 
Earlier forms of économie activities were mainly decided by the mercifulness of nature: the 
fertility of the soil and the feasibility of the climate. Later forms of the economy, such as 
commerce and industry, were due equally to natural factors and social factors, in particular, to 
the invention of instruments and innovation of institutions. As the newest form of economy, 
the infonnation economy is mostly established on infonnation Systems. 

Infonnation Systems are producer, container, processor, and transmitter of infonnation. 
The Internet bears an identity of technological création and technological concept, under 
which the connection of computers forms a network, while the congrégation of networks 
forms the Internet (Forcier and Descy 2002, pp. 40-60), being borderless and decentralized, 
and connecting global computers by Hypertext Transfer Protocol (HTTP). The Internet is 
merely a wide-reaching congrégation of computer networks supported by Internet technology, 
providing possibilities of mutual communications and of access to information. 38 It does, 


j7 See Mead (1999), defming cyberization as “the process of making the whole world digital instead 
of analogue so it can be available anywhere, any time—the essence of cyberspace.” (p. 11) 

’ s Reno v. American Civil Liberties Union, Suprême Court No. 96-511, 26 June 1997. 
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therefore, not only link machines, but also more importantly “links people, institutions, 
corporations and governments around the world.” 39 Each of the services that the Internet 
makes available may possibly bring about legal problems, increasing opportunities of 
cybercrime (Grabosky 2000, pp. 2-3.) 

Although countless statistics and empirical studies hâve tried to depict the development 
of the Internet, in this section, I shall try to présent an illustration of the Internet through such 
aspects as the increase of Internet users, web sites, Internet hosts, 40 web pages, bandwidth, 
and the growth of e-commerce. I make use of the tenn “indicator” to dénoté these factors in 
describing the size of the Internet. 

The flrst indicator is the number of personal computers (PCs) and the Internet users. The 
scale at which information technology has influenced society can roughly be measured by the 
proportion of the population with access to computers and the Internet. The primary function 
of information Systems is to process and share information. 41 The more the computers are 
manufactured, traded and used, to a higher extent will society dépend on this intelligent 
machine. The more the people are connected to the Internet, the greater the share information 
systems-mediated télécommunications will hâve for the entire market. In no easy way can we 
count personal computers in use globally, but according to the International 
Télécommunications Union, up to 2004, there were approximately 772 million personal 
computers in use in the world (GeoHive 2006). It means that practically thirteen percent of 
the world population are PC users (ibid.). While the Internet has expanded into 214 countries 
and world régions, the worldwide Internet users hâve been increasing fast in the past ten 
years. 42 The Internet users reached one billion in 2005, 1.15 billion in 2007, and the growth 
rate is still high (Internetworldstats.com 2007). 

The number of Internet users has a high referential value in measuring the importance of 
cybersecurity, and the hannfulness of cybercrime. The increase in the number of users 

39 American Civil Liberties Union v. Johnson (Tenth Circuit No. 98-2199, November 1999). 

40 Host computer is “a computer that is attached to a network and provides services other than simply 
acting as a store-and-forward processor or communication switch.” Daintith (2004), p. 247. 

41 Panavision Intl. v. Toeppen, Ninth Circuit No. 97-55467, D. C. No. CV-96-03284-DDP, 17 April 
1998. 

42 Of the 233 countries and régions in the world, only the data for 19 countries are unavailable 
according to the Web site ofIntemetstats.com. See Intemetworldstats.com (2007). 


83 



represents a transition from non-PC-users to PC users, from non-Intemet-users to Internet 
users, which in tum represents a transition from a lower likelihood of being informed to a 
higher likelihood of being informed—infonned by information of various value orientations: 
coincident with inhérent value notion, or contradictory to it. Problems emerge during the 
process of personal changes to PC usage caused by the subséquent access to more 
information and social changes as a resuit of its members’ access to ever-more information. 

Suppose the total population constant, the users are fewer than non-users but increasing 
at a phénoménal rate, while the non-users are more than users but decreasing, a movement 
from non-users to users. I think of the process as a sandglass. The increase of users is like the 
flow of sand from the top bulb to the bottom bulb. As to what happens in the sandglass, 
conflict and crash are inévitable. So it is between users: old users and old users, old users and 
new users, new users and new users and actually between old users and non-users, and new 
users and non-users, and so forth. If we consider these users are in different organizational 
forms, it will become more complex: individual users versus corporate users, and so forth. 

Users are not only the subjects in the maintenance of cyberspace order; they are among 
the potential victims of cybercrime. They may benefït from online activities, and at the same 
time, they may otherwise suffer losses when targeted by cybercriminals. The figure 
represents the growth of the online population, with a growth rate of 219.8 percent from 2000 
to 2007 (Internetworldstats.com, 2007), which is increasing by a surprising rate compared 
with population in the traditional society, which has a growth rate of 1.14 percent. 43 The 
citizens in the traditional society do not decrease as the netizens in the cyberspace increase. 
However, more and more people are obtaining the dual identity as both citizens in society and 
netizens in the cyberspace. The Internet pénétration in the whole world has reached 17.6 
percent (Intemetworldstats.com, 2007). In Europe, it is still higher, with a percentage of 
nearly forty (ibid.). Among them, the Nordic countries hâve a pénétration beyond 60 percent 
(ibid.), being a régional pioneer in the world. 

The crime rate in cyberspace may be low at présent. Suppose this rate constant, the 
absolute number of cybercrime, however, increases along with the growth of the population 

43 CIA, The World Factbook, 15 Mardi 2007. Retrieved 15 Mardi 2007, from 
https://www.cia.gov/cia/publications/factbook/geos/xx.html 
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base of Internet users. 44 Consequently, the number of Internet users is valuable in the 
calculation of the number and even the rate of cybercrime, in comparison with those figures 
in traditional society. 

On the other hand, given that cybercriminals are also among the Internet users, their 
growing number and their increasingly extensive geographical distribution indicate the 
difficulties in cyberspace régulation, cybercriminal détection, investigation, jurisdiction, 
identification, and conviction, and the costs and effectiveness in crime prévention. The 
Internet has been expanded to virtually ail countries in the world. The Internet contents are 
using more and more kinds of languages, but with a relative concentration in some main 
languages, such as English, Chinese, Spanish, Japanese, German, French, Portuguese, Korean, 
Italian, and Arabie (Internetworldstats.com 2007). People understanding different languages 
will be more or less Internet-infonned, but people who understand the main languages will be 
more Intemet-infonned. Therefore, the possible impact of online information on users who 
understand different languages differs. These numbers and ratios will be constructive in 
understanding the controllability of the Internet and thus the characteristics of cybercrime. 

The second indicator is the increase in the number of web sites, which represents the 
number of cyber actors, the quantity of cyber resources, the range of services that users can 
consume, and the number of places that the potential customers can visit. A Netcraft survey 
in July 2006 found that there were more than 88.2 million web sites on the Internet. 45 From 
the increasing process of the Internet domain names worldwide, an accelerated ratio of 
increase can be discovered from the late 1990s. 

The primary function of web sites is to serve the Internet users’ needs of information 
resources. It is an important fonn of infonnation publication, which acts as the counterpart to 
the traditional printed press. The growth of cyberspace population and the growth of web 
sites interact with each other. The users include publishers and readers, both of whom can 
exchange their status with each other. The growing number of web sites accommodâtes more 
users, while the growing number of users propels the development of web sites. It is possible 

44 Similarly, Parker and Nycum (1984, p. 314) estimated that the volume of computer crime would 
increase due to the growth in the number of computers. 

45 Netcraft. July 2006 Web Server Survey, 28 June 2006. Retrieved 15 March 2007, from 
http://news.netcraft.com/archives/web_server_survey.html 
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that criminals will be destructive towards the web sites, and in turn, that the users’ interests 
will be damaged thereby. The web sites can also facilitate activities unsuitable for the 
participation of certain groups of people or the web sites may to publish content unsuitable 
for certain groups of people to retrieve. Lack of a unified conception concerning whether or 
not to monitor or censor the use of the Internet may leave this public forum in a status of 
anarchy and confusion. 

In addition, the location of web sites is not the équivalent to in the traditional sense. A 
web site may exist in several régions or countries simultaneously, including at least in the 
following possible places: 

The location of the web site registration, 

The location of the web site owner, 

The location of the web site server, 

The location of the content author, 

The location of the web site manager (webmaster), 

The location of the web site retriever, 

The location of where the language of the web site is mainly spoken by the native 
people, 

The location of where the web site can mainly be accessed, and where the web site can 
hâve an actual influence, etc. 

Détermination of jurisdiction and harmonization of législations are based significantly 
upon these different kinds of locations. The simultaneous involvement of many locations in a 
single act makes it difficult to select a certain location as the nexus for jurisdiction. The 
involvement of more locations during the process of infonnation transmission and the 
complexity of tracing backward pose obstacles for determining the just location. Information 
Systems become an infonnation high sea full of information flow. 

The third indicator is the number of Internet hosts. An Internet host dénotés a computer 
connected directly to the Internet; regularly, an Internet Service Provider (ISP)’s computer is 
a host. The number of hosts is an indicator for the Internet connectivity. As of July 2006, the 
number of Internet hosts reached 439 million (Internet System Consortium, ISC 2006). From 
the ISC (2006), the development of Internet hosts from 1969 to 2006 showed that the 
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development was relatively slow in the first two and a half décades, and began to accelerate 
from the mid-1990s. 


A significant aspect of cybersecurity is correlated with the accessibility to computers 
and networks. Occasionally, these computers and networks are the targets of cybercrime. In 
these cases, the damaged computers and networks become sources of losses suffered by users. 
As part of the hardware of the entire Internet, Internet hosts are also important reference 
factors when considering the prévention of cybercrimes. 

The fourth indicator is the number of web pages. 46 As of 2007, the Google search 
engine collected 8 billion of web sites, indexed nearly 10 billion of distinct web pages, 
several billion of ail types of images: photos, drawings, paintings, sketches, cartoons, posters, 
and more. 47 It is a complicated matter to correctly provide an accurate quantitative 
measurement of the growth rate of the Internet. The search engine and web site survey hâve 
been regarded as useful ways (Tehan 2002, p. 7). The increase of the number of web pages 
basically indicates that web-based information with positive value and with négative value is 
increasing simultaneously. The increase in web pages has had multiple influences on online 
users. The more the web pages are published, the easier the users can discover the appropriate 
contents, but the less successful the webmasters can maintain them. The faster the web pages 
are increasing, the more complicated the situation will be on the part of both webmasters and 
users in terms of obtaining information, maintaining the contents, and avoiding legal 
problems. 

The flfth indicator is bandwidth growth. Bandwidth measures the capability of the 
communications channel. Bandwidth growth facilitâtes more users and more convenient 
online activities. The lowered cost and enhanced quality of services attract people of various 
âges, different income levels and educational background to join the online community. A 
longer online time also becomes possible. Therefore, bandwidth growth directly influences 
the number of online users, the length of online time, and the categories of online activities. 


46 “A web page is a computer data file that can include names, words, messages, pictures, sounds, and 
link s to other information.” See Panavision Intl. v. Toeppen, Ninth Circuit No. 97-55467, D. C. No. 
CV-96-03284-DDP, 17April 1998. 

47 See Google.com’s self-description (Chinese version. There may be no such description in versions 

of other languages), Retri eved 15 Mardi 2007, from 

http://www.google.com/intl/zh-CN/options/index.html 
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The sixth indicator is the growth of scale of e-commerce. UN (1997) noted that “an 
increasing number of transactions in international trade are carried out by means of electronic 
data interchanges and other means of communication, commonly referred to as ‘electronic 
commerce’, which involve the use of alternatives to paper-based methods of communications 
and storage of information.” 48 Although e-commerce is different from those 
above-mentioned factors that are directly related to the scale of the Internet, to some extent, 
nevertheless, we can quantifÿ how many commercial opportunities and interests rely on 
cybersecurity. That is to say, any cybercrimes that shake the foundation of the Internet will 
hâve influences on e-commerce. Direct or indirect, tangible or intangible, 49 pecuniary or 
non-pecuniary losses can be caused by various kinds of cybercrimes. Therefore, a brief 
introduction to the growth of e-commerce is not meaningless. At least, in considering the 
cybersecurity investment and the cybersecurity financing, the scale of e-commerce can be a 
valuable parameter for making such estimate. 

In fact, in the U. S. alone, five years after the introduction of the WWW, the size of 
Internet economy can compete with traditional sectors, such as energy, automobiles, and 
télécommunications (Centre for Research in Electronic Commerce 1999, p. 8). The Internet 
economy also rewrote the history of the employment market (Ibid, p. 9). 

Integrity and reliability of information are important for e-commerce . 50 Along with the 
development of e-commerce, criminals are also transmitting their activities online. The 
increasing dependence of business on infonnation Systems is gradually changing the global 
social-economic scénario. 

In fact, besides e-commerce, many other industries more or less dépend on information 
Systems. More people, more assets, and more activities continue to go online, the efficiency 
of social actions reaches an unparalleled degree on the one hand, the over-dependence on 
information Systems also brings about new risks that society would never hâve met without 

4S UN General Assembly Resolution A/RES/51/162 (30 January 1997). 

49 Concerning costs of crime, see Levinson (2002), pp. 336-343, particularly, direct and indirect, 
tangible and intangible losses of general crime, see Levinson (2002), p. 338. 

50 This kind of récognition makes it impérative for international legal instruments to coordinate 
position of different countries, for example, Annex to UN General Assembly Resolution 
A/RES/51/162 (30 January 1997), the Model Law on Electronic Commerce of the United Nations on 
International Trade Law, Article 8. 



the Systems on the other hand. It is unnecessary to overemphasize the catastrophic effect of 
the possible interruption of information Systems. However, we should bear in mind that the 
increasing dependence on information Systems would cause more and larger risks for the 
society. Social disorganization is usually associated with social change, particularly, 
innovation (Mowrer 1942, p. 32). The information society has the tendency of disorganizing 
in a more informed way. 

The society is transiting firom the process of urbanization to cyberization. An 
information supercontinent is taking shape. The increasing significance of the Internet for 
society and the accumulated threats of abuse deserve universal attention. 

The following sections will analyse the basic properties of networked information 
Systems and their primary impacts on the maintenance of social order. 


3.2 The uncontrollability of networked activities 

Comparison is the core of wisdom. Knowledge about traditional society has been 
accumulated for centuries and it is known either through coinmon sense or as technical 
strategies. Our knowledge about information Systems and social control on the background of 
the pervasive information Systems is to be acquired through comparative study, extending 
firom the old to the new. What we observe, describe and explore about the information 
society dépends heavily on what we did about traditional society. 51 

ICT facilitâtes free and, frequently, a trans-territorial flow of infonnation. The security 
of infonnation Systems has also been a topic discussed in many literatures from very early 
years. For example, Bequai (1983, pp. 192-222), and Icove and co-workers (1995) covered a 
wide range of issues connected with computer security. It requires a spécial forum to provide 
an answer to the question of whether it is technically, morally, or legally suitable for the 
Internet to be managed, regulated, or controlled. But a fundamental conclusion is that the 
security of information Systems is only relative. Absolute cybersecurity did not in the past, 
does not in the présent, and will not in the future, exist. Alexander Hellemans (1999) reported 

51 For the value of comparison in social sciences, see Gerring (2005), pp. 157-159. 
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that, using a complicated algorithm and software, scientists broke the RSA-155 code, which 
is a popular means for protecting secret information on the Internet in Europe, even though it 
is an issue for researchers to spend 5 months on 300 PCs and a Cray 916 supercomputer (p. 
1472). 

In this section, I merely explore the difficulties in exercising control over the Internet. 
Controllability permits management to exercise a directing or restraining influence over its 
use, behaviour, and content (Fisher 1984, p. 24). Controllability of the Internet has a direct 
influence on cybersecurity. The concept of uncontrollability originates from the vulnerability 
of ICT acknowledged by the pre-Internet writers. Bequai (1978, pp. 9-17), for instance, 
divided the operation of the System into five stages (input, programming, Central Processing 
Unit, output and communication process) and asserted that each of these stages is vulnérable 
to attacks by the perpetrators. Bequai (1983, pp. 4-7) raised four reasons why computer 
technology is vulnérable: (1) it is vulnérable to abuse, particularly physical attacks and 
embezzlement; (2) it provides opportunities for various kinds of thefts; (3) it threatens every 
user with the development of human dependence on the machine; and (4) it functions in a 
“corrupt environment” where white-collar crime prevails. 52 He concluded that “crimes by 
computer can be easy” (Bequai 1983, pp. 16-26). 

Nevertheless, Kollock and Smith (1999, pp. 3-28) studied “the landscape of cyberspace”, 
and presented a constructive analysis of the social order in the Internet environment. In the 
following paragraphs, the ideas of both Bequai and Kollock and Smith will be explored. 

By turning to the vulnerabilities of information Systems, I am not going to prétend that I 
am witnessing information society in a completely pessimistic way. Rather, this background 
présentation serves just the purpose of writing about crime. Before beginning the discussion 
about the damage caused by the uncontrollability of information Systems, I would like to 
recall that sometimes vulnerability is useful for some persons and some institutions of good 


52 White-collar crime is a term coined by the American criminologist Edwin Sutherland in 1939. He 
defmed it as “a crime committed by persons of respectability and high social status in the course of his 
occupation.” (Sutherland 1949, p. 9) Sutherland made efforts at reshaping the picture of criminals 
from the traditional conceptions of depicting them as uneducated, unemployed, dissatisfied in 
économie needs and violent so as to include also the educated, the employed, and those enjoying a 
social récognition for their contribution to society. 
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will at sonie time and under some circumstances. 53 

This section will emphasize and expand the analysis of the security problems usually 
involved in major Internet services. The characteristics of Internet services with spécial 
regard to controllability can be summarized in the following nine respects. 


3.2.1 The universal accessibility of the Internet 


Universal access to the networked information Systems can hâve both positive and 
négative rôles in terms of social development and social control. Positive, because the society 
is networked and the networks are available to more and more members of society. Négative, 
because the traditional social networks hâve been replaced and the members are moving to 
and constructing new networks. The impotence of the old order and the absence of the new 
order will create an intégration vacuum, to be expressed in the forai of anarchy and chaos, for 
a process of disintegration and disorganization can be anticipated during this transfonnation 
(see Mowrer 1942; Elliot and Merrill 1961). 

Since the removal in the 1990s of access constraints on the Internet for commercial use, 
the premises in which Internet access service is available hâve been rapidly extended. Besides 
regular users in schools and companies, cyber cafés 54 and homes also facilitate the access of a 
significant number of users. In some countries, the management of cyber cafés forms the main 
path to cybersecurity. Cyber café has become the paradise of school-aged juvéniles who play 
truant. Many problematic youths spend a long time in cyber cafés chatting, gaming, gambling, 

53 For example, in United States v. Jarrett (Fourth Circuit No. 02-4953, 3 June 2003), the key evidence 
of the cases (conceming child pomography) was provided via e-mail to the law enforcement by an 
unknown hacker, who used a Trojan Horse programme attached to a picture and succeeded in 
accessing to the perpetrator's computer upon his downloading the picture. In United States v. Steiger 
(the Eleventh Circuit No. 01-15788, 01-16100 and 01-16269, 14 January 2003), an unknown hacker 
reported his fmdings, upon access to the perpetrator's computer with the help of Trojan Horse 
programme attached to a fake programme, of a crime clue to the police. Interestingly, both unknown 
hackers were from Turkey, but never appeared in court. 

54 The concept of cyber café possibly originated in the U. S. in early 1990 (Steward 2000). It is a 
place where Internet access is provided as the primary service. The adjunct services may include sales 
of various drinks, foods, and other goods. In some countries, the cyber cafés were the main places 
where people could access the Internet during the earlier days of network development. The current 
cyber cafés are still playing a critical rôle in providing Internet access in towns and cities with a great 
mobile population. 
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and entertaining. The cyber café is a place devoid of supervision and restraint as far as both 
private and public sectors are concerned. Neither families nor educational institutions can 
exercise control over activities in cyber cafés. In addition, the owners of cyber cafés are 
usually motivated by profits and do not care about the users’ activities. For instance, many 
cyber cafés in cities and towns are opened unlicensed due to the failure to meet the 
requirements of the fire codes. 55 Besides the physical security and Internet addiction, the 
cyber cafés also involve cybersecurity concerns. Hackers 56 and gangsters are increasingly 
crowding to the Internet, the cyber cafés being a paradise for them. According to the National 
Police Agency of Japan, more than half of computer crimes in 2005 were committed by using 
computer in cyber cafés. An increasing number of Japanese in their twenties and thirties, as 
well as many homeless people, select cyber cafés, which offer a “bed and Internet” package, 
as their home. 57 

It is not difficult to comprehend that some Asian countries hâve outlawed unlicensed 
cyber cafés. A measure of this kind matches crime prévention and crime control in other 
countries with a different political situation and cultural background. People from countries 
without the “cyber-café syndrome” definitely cannot approve such crime prévention measures, 


55 Lu, L. Online Survivors in China, 13-20 April 2006, Beijing Review. 

56 The term "hacker" has so many different meanings when it dénotés different groups of people that 
we cannot give an accurate définition (Thomas 2002, p. 3). The original meaning of the term "hacker" 
dénotés those who enjoy “making computers do new things, or do old things in a new and clever way. 
The hacker is usually quite good at his craft, but may very well not be a professional computer 
programmer or designer. The hacker's work may be useful or may be just a game.” (Warren 2003, p. 
xiv). 

However, the current understandings of the public about hackers can be classified into three 
primary categories: the altruist hacker, the neutral hacker, and the malicious hacker. The good hacker 
is a hacker who tries to find loopholes in the information System and fix them, without intruding into 
the others’ System. The neutral hacker may be described as a person who cares more about his own 
technological achievements but not others’ welfare and security. The malicious hacker is one who 
attempts to practise unauthorized access to the others’ Systems. Today, the most common use of this 
term has almost become an équivalent to computer criminal or perpetrator, a person who attempts to 
obtain unauthorized remote access to a computer System. See Daintith (2004), p. 235. 

Taylor (1997) pointed out that “...despite the media portrayal, hacking is not, and never has been, 
a simple case of ‘electronic vandals’ versus the good guys: the truth is much more complex. The 
boundaries between hacking, the security industry and academia, for example, are often relatively 
fluid. In addition, hacking has significance outside of its immédiate environment: the disputes that 
surround it symbolize society's attempts to shape the values of the informational environments we will 
inhabit tomorrow.” See message dated: 18 June 1997, From: R A. Taylor@sociology.salford.ac.uk, 
Subject: File 1— Paul Taylor's Forthcoming "Hacker" Book. 

57 Konstantin Kornakov, Cyber Café -or the Scene of Cybercrime, 5 March 2007. Retrieved 15 March 
2007, from http://www.viruslist.com/en/news?id=208274049. 
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and usually protest against governmental actions that shut down cyber cafés. Such protests 
raise the issue of closing down these premises to the level of a human-rights question. It is 
then maintained that closure means a threat to information access and freedom of expression. 
Such a standpoint ignores security and crime concems. Issues of rights and of crime are 
always interrelated. It is worth noting that in most European countries, thanks to better living 
standards, educational and other conditions for the development of a broad bandwidth, the 
cyber cafés are less developed. The full extent of the issue is thus neglected. 

Universal accessibility does not mean that there are no different patterns of usage. People 
of different âges may spend a different length of time online in carrying out their different 
goals. People of different gender may exchange different infonnation inside and outside their 
groups. People in countries in different developing stages may hâve a different Internet 
pénétration ratio. People are ail bom equal, but equality of access to information has not been 
achieved, and equality does not mean sameness. Sonie people do not want any more 
information. The impact of information Systems on different individuals, groups, 
organizations and agencies is, therefore, one of different styles: bénéficiai or harmful, positive 
or négative. 


3.2.2 The invisibility of cyberspace 

Conventional countenneasures and théories about crime prévention were based on its 
material influence and on the material environment, although non-material factors hâve long 
existed, too. Activities in information Systems can be expressed in a physically invisible form. 
What are physically visible in information Systems are those physical existences, such as 
hosts and terminais, displayers, keyboards, mouse, and cables, while the mechanisms by 
which the computers function are invisible. Cyberspace is developed from infonnation 
Systems as an abstract space, differing from the material devices of information Systems that 
include terminais and cables. 58 It is invisible and intangible if compared with traditional 
space (Khosrow-Pour 1998, p. 440; Robertson 2000, p. 248; Dodge and Kitchin 2001, p. 81). 

5S See description in Gibson (1984), etc. 
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When a web page is surfed, what can be seen is only the display of information on the screen. 
The web site is not physically a reading room where people can read magazines, newspapers 
and books, listen to audio records or watch videos, nor a marketplace, bank, Street, or forum. 
It is merely a collection of web pages written in various mark-up languages, comprised of 
letters, numbers, and symbols in common use, but which facilitate the functions of linkage to 
other media, communicating with other people or directing to other services. The electronic 
address is not necessarily located along a Street, in a building or even in a city, province, or 
country. In addition, the online services are usually provided in the manner of a remote 
transaction paid by means of digital cash or Virtual money. Finally, the Internet users include 
individuals and institutions, but they do not necessarily appear in person or in an entity in a 
traditional library, forum, marketplace, bank, or along a Street. It is entirely an invisible 
community in an invisible space. 


3.2.3 The low controllability of the process 

Since the early days of the computer and the Internet, efforts hâve not been lacking to 
control the System. Theoretically, the Internet can be controlled; however, actual and perfect 
control is unattainable. Thus, it is reasonable to say that the Internet can be controlled by any 
of the users if there is anyone trying to exercise control over part of it; but it cannot be 
controlled by any of the users if they want to exercise absolute control over the whole System. 
The low controllability by one means, on the other hand, the high possibility of control by 
many others. The low controllability by authorized users means the high possibility of control 
by unauthorized uses. 

According to Kollock and Smith (1999, pp. 3-28), the Internet services hâve a very low 
controllability, even though it does not in my opinion greatly affect the social order (see 
Section 3.2). They explained the mechanisms of e-mail, Usenet, and WWW, which are the 
commonest means of communications and information exchange between online users. Both 
firee and paid services are available online on an immense scale. E-mail lists, Usenet, and 
WWW are used to distribute messages simultaneously to ail the subscribers of the lists or 
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Usenet, or published for public access. To some extent, owners, administrators or servers of 
e-mail lists, Usenet and WWW hâve a certain degree of controllability when owners décidé 
publish or refuse the messages. However, the openness of most e-mail lists, Usenet and even 
WWW enables users from everywhere to publish messages. To review a substantial quantity 
of messages requires considérable time and labour. What makes it a challenging social space 
is that any online users can write, publish, retrieve and save the contents, meaning that they 
expose themselves to anonymous users and trans-territorial users (see Kollock and Smith 
1999, pp. 3-28). 

Kehoe (1993) has discussed the situation of Usenet. He has claimed that the Usenet is 
not an organization, devoid of central authority; not a democracy, because democracy also 
requires organization; not fair, because unfair things will be discontinued by no one; nor a 
public utility, because of little or no control (pp. 36-38). Kindon (1994) concluded that the 
Usenet control ends at the newsgroup level 59 rather than at the individual level. Messages 
can be distributed among thousands of computers worldwide, and the establishment of 
jurisdiction over disputes and offences is impossible. 

Controllability of online instant messages is yet lower than the above-mentioned 
services. During the instant communication, the sending and receiving of the messages 
happen in a nearly synchronous manner. If these messages contain offensive contents, or 
hyper links to an offensive web page, there is no sure way of providing prearranged measures 
for precluding them. There do exist certain kinds of fïltering and blocking mechanisms, but it 
is still a problematic matter whether these mechanisms are effective in passing and blocking 
the exact messages. While the filtering mechanisms are based upon logic coding under the 
hypothesis of rational human activity, the ways in which filtering and blocking programmes 
can be rendered invalid are simple and multiple. For example, the substitution of letters by 
similar numbers or symbols, or use of icons as words and phrases, is a method that is easy to 
use but difficult to filter. 

Even if it is merely an individual e-mail, it is still confronted with uncontrollable threats. 

59 “Newsgroup is an Internet discussion group that focuses on a particular topic. Users of the 
newsgroup share messages and can download files; including images...there are automated processes, 
such as news servers, allowing individuals to automatically receive files on a particular subject.” 
(United States v. Slanian) 
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Kelly (2002) has mentioned the three primary aspects, that is, the loss of the confidentiality 
of e-mailed information, the distortablity and misinterpretation of content and the possible 
liability of an institution for the message as a publication. 

The above analysis enables us to draw the natural conclusion that the control over the 
process of the Internet services is theoretically possible but practically unfeasible. The 
impossibility of control over the Internet immunizes individuals and institutions from any 
liability for the omission of such a control. Under these circumstances, neither an ex ante 
obligation nor an ex post liability can be adhered to as far as related individuals and 
institutions are concerned. Thus the incentive for control will hardly be strong. 


3.2.4 The disputability of content and activities 

The old and new diversity between cultures, societies and laws has not necessarily been 
diminished by the coinmon networks of information Systems. On the contrary, universal 
information Systems bring in a diversity from offline to online, and bring about a diversity 
between offline and online. For example, we see that while there are different versions of 
religious classics on the networks, there are also different versions of political works online. 
People hâve the équivalent chance to read various versions of holy books. If they are to 
establish a belief different from their previous ones, they are equally likely to be influenced 
by this version or that version. Thus, from the viewpoint that information Systems form a 
space accommodating different cultures and ethnicities, we cannot expect too much of them, 
because they hâve the power both to create and to some extent eliminate diversities. The 
connection of the Internet to current legal frameworks, including restrictions on displaying 
unfeasible materials, the protection of privacy, and the limits of pennitted business ail 
become the subject-matter of major legal argument. 60 This has become a well-established 
conclusion. 

The capacity of an uncomplicated publishing process makes the web pages an important 
media for businesses and individuals wishing to convey infonnation to almost as many 

60 Citron and Toronto Mayor's Committee v. Zundel, 2002 CanLII 23557 (C.H.R.T.). 
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people as possible (Williams 2001). Every online user is able to contribute to certain kinds of 
publications: scholars shift their academie joumals to inexpensive and easy-spreading digital 
versions; students put their essays on the bulletin-board System; and dissidents establish web 
sites to publish statements against the political authorities. In addition to technological 
problems, online content also involve two aspects of legal problems: the protection of firee 
speech in some countries and the prohibition of offensive speech in some other countries. 
Freedom of speech or freedom of opinion and expression is provided as basic human rights in 
international agreements and domestic constitutions. 61 For example, Section 12 (1) of 
Constitution of Republic of Finland prescribes that: 

“Everyone has the freedom of expression. Freedom of expression entails the right to 
express, disseminate and receive infonnation, opinions and other communications without 
prior prévention by anyone. More detailed provisions on the exercise of the freedom of 
expression are laid down by an Act. Provisions on restrictions relating to pictorial 
programmes that are necessary for the protection of children may be laid down by an Act.” 62 

Many other countries hâve similar clauses in their constitutions. Although the literal 
wording in the constitutions may be similar, the judgment standards of firee speech are 
different. What is visible is only the wording of the clauses, but what is invisible is their legal 
spirit. In some countries, the law of free speech protects online messages, and refusai of 
publication requests and délétion of published messages may bring about legal disputes. In 
some other countries, these messages may be legally or religiously offensive. Even within 
one country, there is also the possibility that the courts rest on positions different from each 
other or different from the relevant législation. For example, in Reno v. American Civil 


61 In The Universal Déclaration of Human Rights 1948, Article 19 prescribed that “Everyone has the 
right of freedom of opinion and expression; this right includes freedom to hold opinions without 
interférence and to seek, receive, and impart information and ideas through any media and régulations 
of frontiers.” 

Other primary international agreements including freedom of opinion and expression are The 
International Covenant on Civil and Political Rights, Articles 19 and 20; The International Convention 
on the Elimination of Ail Forms of Racial Discrimination, Articles 4 and 5; The American Convention 
on Human Rights, Article 13; The African Charter on Human and People’s Rights, Article 9; The 
European Convention on Human Rights, Article 10; The European Convention on Human Rights, 
Article 10, etc. For more information, see Lawson (ed. 1996). 

62 Constitution of Republic of Finland (731/1999), Section 12 (1). See FINLEX, an unofficial 
translation. Retrieved 15 Mardi 2007, from http://www.fmlex.fi/pdf/saadkaan/E9990731.PDF. 
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Liberties Union, 63 the court struck down a fédéral provision prohibiting the ending or 
displaying of obviously disgusting material in a style available to anyone less than eighteen 
years of âge. The court ruled that the prohibition violated the First Amendment. 64 In Ashcroft 
v. Free Speech Coalition et al., 65 the Suprême Court of the U. S. upheld the Child 
Pornography Prévention Act of 1996 (CPPA), which expands the fédéral prohibition on child 
pornography to both pornographie images made using actual children and “virtual child 
pornography.” 

These factors detennine that controllability of the Internet, the legal Foundation of 
control, the willingness to control, and actual control over the Internet are conditionally 
dépendent. Under such circumstances, it is not groundless for technological supremacists to 
suppose that the Internet lists will assist in the realization of their anarchist idéal. 

For example, with the help of the Internet, the pornographie economy has developed on 
a great scale. It is true that obscene texts, graphies, and audio and video fdes hâve a different 
status in different cultural contexts. They may be legal for ail people. They may also be 
illégal for ail people. However, in most cases, they are legal for adults, but illégal for 
juvéniles. In addition, the content of obscene files does not matter: description or illustration 
of children often render the whole file illégal, because this is regarded as sexually exploiting 
children. In any case, if the file is illégal, acts with the intent to create, record, possess, 
présent, publish, replicate, disseminate, trade, advertise and so forth are ail illégal. Even 
collecting and enjoying them by oneself will be punished. According to the Penal Law of 
Finland, dissémination of the depiction of obscenity, possession of obscene pictures of 
children and unlawful marketing of obscene material are ail criminalized. 66 However, that 
the incentive of benefiting from the commercial transaction of pornography motivâtes the 
Internet content providers or Internet users means that it is difficult to control the Internet 
content. 


63 Reno v. American Civil Liberties Union (Suprême Court No. 96-511, 26 June 1997). 

64 Fallon (2004), p. 53. The First Amendment was implemented in 1791 prescribed that “Congress 
shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or 
abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and 
to pétition the Government for a redress of grievances.” 

65 Ashcroft v. Free Speech Coalition, 535 U.S. 234 (2002), DocketNo. 00-795 - April 16 2002. 

66 Penal Code of Finland, Chapter 17, Sections 18-20 (563/1998). 
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In addition to the fact that the digital form of traditional verbal, written, printed, audio as 
well as video content inherits these above-mentioned traditional prohibitions, the Internet 
further inherits the problem enforcing the illégal nature of some activities, such as gambling, 
along with the trade in some materials, such as drugs, philtres, and weapons. Some of these 
fields are in dispute. The most controversial issue may be the criminalizing or legalizing of 
gambling and marijuana. The momentousness of these topics in contemporary society has 
attracted the attention of multitudinous studies and research. Now, despite their legal status in 
different countries, exchange of information about these activities and materials, transaction 
and payment, necessary offline delivery of goods, and possible internationally prohibited 
money transfer in some areas, may create unsolvable problems for control over the Internet. 

Infonnation Systems can accommodate contents of different value-orientation and 
activities of a differing legal nature, usually creating controversies among the various 
jurisdictions. As a resuit, the authorities in the country where the content or activities are 
legal cannot provide sufficient protection for people who publicize legitimate speech or carry 
out legitimate activities, and cannot prohibit infringements and impose sanctions on people 
who infringe these legal rights. Similarly, authorities in a country where the contents or 
activities are illégal cannot impose sanctions on people who breach the proscription, and 
cannot protect people who obstruct the illégal contents or activities from wrong prosecution 
by a country where people adopt contrary standpoints to the legal nature of these contents or 
activities. In Europe, this dispute exists in the respect of speech conceming the identification 
of several historical incidents, such as the génocide of certain races, déniai of which may 
induce criminal prosecution in countries including Austria, Belgium, the Czech Republic, 
France, Germany, Italy, Lithuania, the Netherlands, Poland, Romania, Slovakia, and 
Switzerland. Déniai of the historical occurrence of génocide is also punishable in Israël. 67 In 
spite of some international conventions, the problems of this paragraph are not in practice 
more easily dealt with than the problems of the proceeding paragraph. 


Wikipedia, Holocaust Déniai. Retrieved 15 Mardi 2007, from 
http://www.wikipedia.org/wiki/Holocaust_denial 
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3.2.5 The divisibility of digital files 


Division is a threat to most forms of life and most forms of existence. However, at the 
same time, division means life and the existence of digitalized information. Digital files exist 
in information Systems and are transmitted through the networks in particular forms. Erol 
(1992) described it as a process of “moving bits from one place to another” (p. 19). In 
transmitting processes, a file is regularly broken into many packets 68 conveyed along the 
networks in different juridictions. For example, if a European user sends a message from his 
or her room to the neighbouring room, the message may be divided into several packets. 
When they are transmitted from one room to another through the Internet, there is the 
possibility that ail packets are transmitted directly through local networks and arrive at the 
destination. Nevertheless, there exists, too, the possibility that certain packets transmitted to 
North America, and then to Africa, or Asia at last arrive in the neighbouring room. It is a 
frequent phenomenon for a single e-mail message to traverse countries in different continents. 
If every country attempts to exercise jurisdiction, the process can become exceedingly 
complex and unmanageable. Plainly put, it may occur that one particular country may simply 
be crossed by certain packets. 

Most of the Internet services involve some kinds of file transmission. For example, 
contents of e-mail, Usenet, chat room, and web page are generally transmitted as files and 
divided into packets during the process. Different packets may be transmitted via different 
routes and different juridictions. Even though in reality infonnation is not divided as 
extremely as we imagine, the possible gap and overlap of législations hâve still become a 
major problem. 


3.2.6 The low confidentiality of information Systems 


Protected data in infonnation Systems should be “obtained and processed fairly and 


6S A packet means “a quantity of information that is sent as a single unit from one computer to another 
on a network or on the Internet.” See Summers (2003), p. 1184. 
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lawfully.” 69 Technical and organizational measures should be taken to protect personal data 
against access without authorization, manipulation, disclosure, transfer and other processing 
without legal reason. 70 Besides general protection of personal data, sensitive personal data 
are granted spécial protection by law. 71 Exceptions are dérogations, 72 which are prohibited 
to process. 73 

Infonnation Systems are usually analogous to a place with unrestricted freedom and 
where the information is less confidential. Weak technical control and weak human control 
are the main factors that expose the weakness of the Systems. The most obvious example is 
e-mail. The technical mechanisms demonstrate that e-mail has exceptionally low 
confîdentiality, and is more vulnérable to disclosure than traditional letters. Without 
encryption, every document sent by e-mail is publicly accessible, and System administrators 
can easily view every outgoing and incoming e-mail without any preceding authorization 
(Sikorski and Peters 1999, p. 348). Kelly (2002) mentioned that the confîdentiality of 
e-mailed infonnation can be lost in such cases as when it is intercepted, when it is sent to a 
wrong address, or when it is read by an unauthorized or unintended person. 

In addition to less prepared gaze, Rogers (2001) worried that the governmental agencies, 
business organizations and other individuals are usually motivated to abuse their powers and 
rights to infringe e-mail privacy. The secrecy of individual interaction in sending and 
receiving e-mails online is easily destroyed, because of being unencrypted. It is possible for 
hackers to tamper with the e-mail, or for the Internet service providers (ISPs) to check the 
packets, resulting in loss of users’ e-mails and disclosure of individual privacy or business 
secrets. This is no different from clandestinely opening other people’s letters, encroaching 
upon other people’s correspondence secret (Wang 2001, p. 154). 

69 Council of Europe Convention for the Protection of Individuals with Regard to Automatic 
Processing of Personal Data, Article 5; Directive 95/46/EC, Article 1 (a). 

70 Convention Article 7; Finnish Personal Data Act 523/1999, Section 32 (1). 

71 According to Finnish Personal Data Act 523/1999, Section 11, sensitive data include data relating to 
or are intended to relate to the following aspects: “(1) race or ethnie origin; (2) the social, political or 
religious affiliation or trade-union membership of a person; (3) a criminal act, punishment or other 
criminal sanction; (4) the State of health, illness or handicap of a person or the treatment or other 
comparable measures directed at the person; (5) the sexual preferences or sex life of a person, or (6) 
the social welfare needs of a person or the benefits, support or other social welfare assistance received 
by the person.” 

72 Finnish Personal Data Act, Section 12. 

73 ibid, Section 11. 
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Computer processing enables “interceptions to be multiplied a hundredfold and to be 
analysed in shorter and shorter time spans.” 74 The interception of electronic correspondence 
has been legalized under different conditions in many countries. For example, according to 
the U. S. Electronic Communication Privacy Act (ECPA), 75 ISP may supervise or intercept 
e-mail infonnation for normal commercial goals and in order to protect property or related 
right. In addition, in the workplace, it is deemed that the employées hâve no privacy in 
company computers. 76 Apart firom legally authorized interception, infringement of privacy 
also poses a great concem. 

In fact, many court decisions in the U. S. hâve rejected the expectation of workplace 
privacy. At workplace, employers and governments provide information Systems for 
work-related use only. Law and policy limit any use for non-work functions. The logic is that 
the use of infonnation Systems for non-work purposes is a breach of law and policy and 
deemed misconduct; then, the search into the personal use of these Systems does not breach 
the privacy rights of their employées. 77 

The mobile networks are as vulnérable as the traditional computer networks. Security 
loopholes usually threaten individual rights and State security. According to the Finnish 
govemment news, a serious data security problem has been discovered in the Finnish 
Ministry of the Interior. With this kind of problem, it became possible to listen to the mobile 
phone calls of thousands of employées without authorization. Consequently, the Ministry had 
to inform the employées not to use mobile phones for conlidcntial aims. The problem 
concerns employées in the police and rescue forces, emergency services, the Border Guard, 
the Directorate of Immigration, the Population Register Centre, and employées within the 


,4 Malone v. The United Kingdom - 8691/79 [1984] ECHR 10 (2 August 1984). 

75 18 U.S.C. §§ 2510-2522; and 18 U.S.C. §§ 2701-2711. The Act amended Title III of the Omnibus 
Crime Control and Safe Streets Act of 1968 (the Wire Tap Statute). 

76 For example, in United States v. Ziegler (No. 05-30177 D. C. No. CR-03-00008-RFC ORDER 
AND OPINION, 6 March 2007), the government argued that: 

“Society could not deem objectively reasonable that privacy interest where an employée uses a 
computer paid for by the company; Internet access paid for by the company, in the company office 
where the company pays the rent...This is certainly even more so true where the company has 
installed a firewall and a whole department of people whose job it was to monitor their employées’ 
Internet activity.” (p. 1087) 

77 See United States v. Wesley George Thom, No. 03-3615, Fédéral Circuits, Eighth Circuit (July 13, 
2004); United States v. Angevine, 281 F.3d 1130, 1134-35 (lOth Cir.); United States v. Simons, 206 
F.3d 392, 398 (4th Cir. 2000), etc. 
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Ministry of the Interior itself. 78 


3.2.7 Anonymity 

The disappearance of physicality in activities on the Internet symbolizes the new way 
for daily routines, and présents a chance for new practice and changes in faiths, positions, and 
manners (Zigrus 2001, p. 171). To a certain extent, Internet services are provided for every 
user who owns a computer and a modem or cable linked to the server. The real identity of the 
user is not necessary for using the Internet. That is to say, a high degree of anonymity is 
achievable. Anonymity could indicate an intention to lie or not, to do something deceit or not. 
In the environment of online communications, particularly during interaction between remote 
strangers, information Systems provide the possibility of maintaining anonymity, and we 
found that the users of information Systems hâve the willingness to stay passively anonymous, 
not necessarily actively lying to their counterparts. 

In the case of e-mail, it is uncomplicated to register an e-mail account with false 
information, or to send messages in the name of a certain person. These e-mails may not only 
infringe the legal rights and interests of the person of the counterfeited identity, but also are 
able to fabricate a rumour, slander other people, harm other people’s réputation, or practise 
unfair compétition to reduce the competitor’s trustworthiness. No obligation of free e-mail 
service providers has been established to investigate the registrants’ identity information. In 
addition, some web sites also provide anonymous e-mail services or sell anonymous e-mail 
software. 79 Under such circumstances, the traceback of the real sender is impossible. Only 
where the providers’ status is clear, under vicarious liability, can it be useful for law 
enforcement in some juridictions to hold the re-publisher responsible for the content of the 
original author (Edwards and Walde, eds. 1997, Part 4). 

E-mail has frequently been abused in an anonymous way so as to realize a fraudulent 


78 Finland Government News, Data Security problems in Ministry Mobile Phones, 15 February 2006. 
Retrieved 15 March 2007, from http://e.fmland.fi/netcomm/news/showarticle.asp?intNWSAID=47840 

79 Examples of such services and software can be searched out with search engines. 
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scheme. This anonymity not only facilitâtes a lie, but may also support a fraud. An actual 
case may illustrate this better. For example, in an advance-fee fraud message, the sender 
fabricated a sériés of facts in order to gain the trust of the récipient, while keeping his or her 
genuine identity unknown: 

1. The sender pretended to be Mr. Harrison Compaore, the manager of bill and exchange 
at the foreign remittance department of the Bank of Africa, located in Festac Town, Lagos 
State, Nigeria, West Africa; 

2. "fie" claimed that they found an abandoned sum of 39.5 million US dollars in the 
account of a foreign customer, Mr. Andréas Schranner, firom Munich, Germany, who died in a 
plane crash in July 2000; 

3. “fie” provided an accessible Internet hyperlink to the BBC story about the crash; 

4. “fie” sought assistance to transfer this sum of money and appropriate it; 

5. “fie” offcred 30 percent of reward for providing a foreign account; 

6. “fie” asked for the recipient’s private téléphoné and fax number; 

7. “fie” asked the récipient to trust him, and to maintain the strictest confidence in the 
transaction. 

In a real case, R. v. Mastronardi, 80 the accused, met the plaintiffs through an Internet 
dating service, during which the accused misrepresented himself as a single person and 
engaged in relationship with several victims. He represented himself as: 

“(a) coming from a large, powerful and wealthy Sicilian family; 

(b) being a widower seeking a wife; 

(c) being a medical doctor with a specialty in gynaecology; 

(d) having hospital privilèges and a clinic; 

(e) being a kind, caring and considerate person with positive family and moral beliefs, 
conveyed in conversations that went on for hours on end; 

(f) having elaborate and sometimes bizarre family and cultural traditions requiring 
highly submissive wives and amalgamation of finances to an account controlled by him; 

(g) as time went on, being third in command in mafia like family organization; 

(h) not wanting to date, but wanting to immediately enter into an intimate relationship, 

80 2006 BCSC 1681. 
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after which his culture and family regarded them as married; 

(i) once so married, his family required him to follow family and cultural traditions.” 
(paragraph 4) 

In R. v. Farkas, the accused engaged in online firaud by using different e-mail addresses, 
mailing addresses, and user naines, victimizing sellers and purchasers distributed in the U. S., 
Canada, and England. 81 In R. v. Reynolds & Ors, the accused engaged in online chat 
claiming himself to be a 16-year-old boy, attempting to make young girls expose their bodies 
and transmit photographs to him over the Internet. 82 

There are many ways by which people make efforts to detect lies, usually including 
various dues to émotion that may disclose the situation of lying (Ekman 1992, as cited in 
Howitt 2002, pp. 251-253). However, in the electronic lie, none of the dues can be useful, 
particularly those emotional ones, because there is no face-to-face interaction. Rather, the 
interaction itself is covered by a human-machine-human (ig leaf. 

Another field where people usually maintain anonymity is interaction in chat rooms. 
Accounting for a considérable fraction of the income of the commercial online providers, 
chat Systems support synchronous communication, discussion on different topics, 
trans-territorial relationships on common interests, and ignorance of social status (Internet 
Crime Forum IRC subgroup 2001, pp. 7-9; Rowland 1998; Wilbur 1997, p. 5.). The biggest 
advantage of the interaction in chat rooms is that the user can keep anonymous at the 
beginning of the chat or remain anonymous during the whole process. Keeping anonymous 
means that people are able to fabricate identities that cannot be used to identifÿ them. By 
disguising themselves, users can perpetrate firaud and many other related activities. This 
approach is definitely useful, too, in détection and investigation of crimes, where law 
enforcement uses falsified identity to allure and arrest suspects. 83 The actual reality is that, in 

81 2006 ONCJ 121, 10 April 2006. 

82 [2007] EWCA Crim 538 (08 Mardi 2007). 

83 For example, in United States v. Helder (Eighth Circuit, No. 05-3387, 16 Mardi 2006), an 
undercover officer used a screen name and claimed to be a 14-year-old girl to entrap the perpetrator (pp. 
2-4); in United States v. Baker (Seventh Circuit, No. 05-2499, 24 January 2006), an undercover officer 
used a screen name and claimed to be a 14-year-old boy to entrap the perpetrator (pp. 2-3); in United 
States v. Antelope (Ninth Circuit No. 03-30557, 8 June, 2004. Docket num. 03-30334, January 2005), 
the accused joined an Internet site advertising "Preteen Nude Sex Pics" and started corresponding with 
an undercover law-enforcement agent, in respect of whom the accused was entrapped when he ordered 
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information Systems, detennining users’ identity proves difficult, but not impossible . 84 


3.2.8 The abuse of services 

The powerfulness of the Internet facilitâtes instant communication and timely 
information exchange, covering an unlimited range of messages and infonnation, désirable or 
undesirable, legal or illégal, bénéficiai or anti-social. The convenience of e-mail for 
communications is frequently exploited as the fastest and easiest ways of spreading computer 
viruses, spam, 85 and firauds over the Internet. 

The e-mail is the primary means for spreading malicious programmes. For example, the 
Love Bug virus reached millions of computers within 36 hours of its release from the 
Philippines thanks to e-mail. 86 Subsequently, these malicious programmes can send 
messages, collect information, delete data, spread a Trojan horse, or plan future accidents 
(Sadowsky and co-workers 2003, p. 48). At the same time, e-mail bombing, that is, sending a 
large amount of e-mails to the victim, can crash the victim’s e-mail account or servers 
(Syngress 2002, p. 325). Therefore, a security concern is closely related to e-mails. 

The e-mail is both the means and the target of spam, utilized primarily for commercial, 
political, malicious, or illégal schemes. As a marketing and communications means, e-mail 
has been gradually abused. Récipients of unsolicited e-mails hâve to spend much time to deal 
with messages, wasting human resources and baffling the receiving of useful messages. The 
sending of bulk mails also consumes network bandwidth and interfères with the ordinary 
communications service. In addition, unsolicited commercial mails are usually sent 

a child pornography video over the Internet; in United States v. McGraw (Tenth Circuit No. 02-1407, 
D. C. No. 01-CR-426-B, 2 December 2003), the accused was also caught by an undercover agent, with 
whom he expressed his interests in “having sexual contact with ‘white males between the âges of 12 
and 15’,” and arranged a encounter. See also R. v. Randall (Provincial Court of Nova Scotia 2006 
NSPC 19, No. 1538177, 28 April 2006). 

84 As Peter Steiner’s cartoon saying that “On the Internet, Nobody knows you’re a dog.” Originally 
appeared in The New Yorker, volume LXIX, number 20, 5 July 1993, p. 61. Retrieved 15 March 2007, 
from http://www.unc.edu/depts/jomc/academics/dri/idog.html 

85 Spam indicates e-mail messages that a computer user has not asked for and does not want to read. 
Summers (2003), p. 1585. 

86 The Love Bug was a famous virus disseminated through attachment to e-mails. 
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anonymously or with a fabricated identity, and the récipients cannot stop subséquent 
messages. Messages of this kind also include false or misleading headers, deceiving 
récipients to retrieve messages that they do not want. Moreover, the récipients hâve no way 
of expressing their wish not to receive such messages, and hâve no way of requesting 
compensation even if they suffer loss. The abuse of e-mail has become a public nuisance in 
the online environment. Although the use of anti-spam services and technologies is 
increasing, the scale of spam is continuing to increase as fast (OECD 2004, pp. 2-3; OECD 
2005, p. 6), becoming a problem not only for personal e-mail accounts, but also for corporate 
accounts. In regulating the legal problems which the e-mail brings, traditional criminal law 
has insufficient coverage. 

Cyberstalkers 87 also abuse the e-mail service by sending text-, graphie-, and 
audio-based messages of a threatening, alarming, or harassing kind to the e-mail account of 
the intended victim (D’Ovidio and Doyle 2003, pp. 10-17). At présent, it is also possible for a 
video-based message to accomplish the équivalent effect. Other Internet services can also be 
exploited by cyberstalkers to harass other users, either directly or indirectly. An example of 
direct harassment can be found when stalker sends harassing messages to a targeted victim. 
An example of indirect harassment can be found when a stalker uses the Internet 
communications to obtain a potential victim’s personal information, such as a home address 
etc., and then uses the information to contact by other means. In these cases, children are 
frequent victims (Internet Crime Forum IRC subgroup 2001, p. 11). 

In many incidents, what has been revealed is “the ail too coinmon failure of both public 
and private sector organizations to ensure that safeguards are identified and diligently 
implemented throughout organizations.” 88 Due to the abuse of online services, it can be said 
that, on the Internet, the use and abuse of the services grow hand-in-hand; and chances and 
challenges exist simultaneously. 


87 Cyberstalking means the illégal use of the Internet, e-mail, or other electronic communications 
Systems to follow someone or threaten him or her. Summers (2003), p. 390. A cyberstalker is one who 
perpétrâtes cyberstalking. 

88 Sale of Provincial Government Computer Tapes Containing Personal Information, Re, 2006 CanLII 
13536 (BC I.P.C.). 
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3.2.9 From information society to mobile society: 89 the uncertainty of the future 


In the technological fïeld, what is certain is the tendency of ceaseless advancement, but 
what is uncertain is the outcome of this ceaseless advancement. ICT is the most dynamic 
fïeld in the présent world. Network technology is one of its relevant aspects. In addition to 
the traditional networks, mobile and wireless networks hâve been developing rapidly in 
recent years. The goal of the new network technology is to integrate the known advantages of 
the previous network, avoiding the known disadvantages, while creating the unknown 
advantages. The most advantageous characteristic of ail the networks is the decentralized 
structure, without central control. The unique advantage of mobile phone and wireless 
networks is the possibility of wider spatial séparation between terminais and network devices. 
Controllability of such networks is being transfonned into new forms. At the same time, the 
existing security concem has also been transplanted into the new media (Karygiannis and 
Owens 2002, pp. 21-22). The future of technology and security are unforeseeable. 

Computer networks form an uncertain phenomenon with which the legal System should 
keep pace. In the last few years, people in the U. K. were fond of quoting an estimate 
according to which the U. K.’s currency reserves can be transferred outside the country in 
fifteen minutes. 90 Both the convenience and dangerous nature of infonnation Systems are 
imaginable. With the traditional network, the online threats emerged about when the wire, 
fibre and cable of the network were to be linked. At the moment, with wireless and mobile 
networks, the invisible threats are emerging in space where the electromagnetic wave of the 
network covers. Although the new technological outcomes are always accompanied by 
corresponding safeguards, historical instances hâve proved that the initial measures hâve 
usually been less effective. In addition, the legal framework is less ready and less prompt in 
reaction to the new phenomenon. As Clarke claimed that, with cybercrime (computer viruses), 

s9 Here we use the term “mobile society” in terms of a society with increasing population are 
connected with mobile télécommunications networks, similar to the term “mobile information society” 
that the International Télécommunications Union used at http://www.itu.int/osg/spu/ni/fiituremobile/ 
(Retrieved 15 Mardi 2007). The term also has other meanings that are irrelevant here. 

90 See Kelly (2002). 
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the collapse of banks, the launching of nuclear missiles, the shutdown of air traffic control, 
and the paralysis of the téléphoné network are ail possible in the future (Clarke 1997, p. 227). 

I will further point out in Chapter 9 that the legal reflections and reactions to the 
criminal reality are usually too sluggish and are not uniform between the different countries. 


3.3 Conclusion 

The Internet créâtes a space without a spatial or temporal boundary. Anyone with 
Internet access is connected to everyone else with Internet access in the world and is likely to 
be afifected by the information that is published and the activities that are facilitated. Ail that 
not only provides chances for a social life, but also poses challenges to the social order. As a 
resuit, Gates (1995) stated that a significant aspect of the Internet is to get rid of remoteness, 
making it no différence between contacting a person in the next room and contacting another 
on another continent. 

On the other hand, security and trust become essential to this new environment, which is 
constructed on Systems vulnérable to attacks or abuse. Computers play different rôles, such as 
means, media, target, tool, place, route in offences, and can be used in varied ways to préparé 
for other offences. People hâve already recognized that the unique character and the great 
value of the Internet for the user community is its decentralized structure (Rotenberg 1990, p. 
16). What is tricky is that the maintenance of cyberspace order proves a challenge to the legal 
System. Many people are aware of the risks that people take when they go online. 
Quirchmayr (1997) pessimistically declared that the Internet became a paradise for ail sorts 
of criminals (cited in Siponen 2001, p. 24). Interpol (2003) summarized the major threats as 
unauthorized access to and destruction of infonnation in the processing, transporting, and 
storing stages. Information and communications technology poses enormous challenges to 
society, and clearly requires criminal-law reform. 

Firstly, the objects requiring the protection of the criminal law hâve been expanded in 
the infonnation âge. The basic logic behind this is that, person, property and information are 
the three kinds of objects to be protected by criminal law, and that while both infringements 
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of person and property are punishable offences, so should the abuse of information Systems 
punishable, too. Although criminal law has protected copyright, patent, trademark, and trade 
secret, the explicit literal provision for protecting “information” in criminal law is a 
development of the three recent décades. However, the provisions of different countries are 
not uniform. Disputes over changing the traditional criminal law are still taking place in some 
countries, and show the persistent résistance of the conventional notion. Ail these factors 
render the renovation of législation an inefficient process. In order for criminal law to hâve 
actual effect, the sooner the renovation of the general theory and general part of criminal law 
are carried out, the better the criminal law can serve the information society. 

Secondly, because of the expansion of the objects to be protected in the criminal law, it 
is very important to provide définition of new types of crimes, and to revise constituent 
éléments of old crimes, in which information Systems become a new tool, object, place, 
medium, route, and means of traditional offences. This situation calls for the change of the 
spécial part of criminal law. If we say that the lag in the general theory of criminal law wastes 
resources in the législation, the failure of the spécial part of the criminal law waste the 
resources in criminal justice, leaving a blank in deterrence as far as new types of crimes and 
new fonns of old crimes are concerned. The effective implémentation of domestic criminal 
laws increasingly dépends on international coordination and coopération, requiring 
realization to a far greater degree of the international consensus of substantial and procédural 
law. 

Thirdly, the space of criminal justice is expanding beyond traditional society. The 
traditional crimes are fundamentally intra-national, trans-national, or at most international, 
while the new-fashioned cybercrimes are easily super-national and even virtual. That is to say, 
the crimes surpass the national power, while the super-national power in criminal justice has 
yet to be formed, being , restricted by the traditional principles of jurisdiction. In order to 1111 
up the gap between the crimes and the power of criminal justice, international criminal law 
has fonnulated some new raies, though they are not widely accepted. A wider range of 
international action should be adopted in order to reduce the large expenses of time, money 
and human resources, and to decrease the further losses caused by crimes that are left 
unpunished in the process when there is this gap in criminal justice. 
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Fourthly, balance has not been reached between the influence of technology on criminal 
justice and on criminal phenomena, both of which are complex and involve positive and 
négative forces. The négative effect of technology on criminal justice and the positive effect 
on criminal phenomena point to a further failure of traditional criminal law: the inability of 
criminal justice and the inefficient deterrence against cybercrime increase the expected 
criminal benefits and lower the expected punishment. As a resuit, the increase of cybercrimes 
is inévitable. To résolve this problem, prompt enactment of domestic législation worldwide 
and negotiation for international coopération are required. 

Fifthly, the dependence of criminal law on technology, and the interaction and mutual 
support between criminal law and technology should reach an unprecedented extent. Without 
the interaction of technology, criminal law could not obtain so great a deterrent effect. 
Similarly, without criminal law, technology could hardly function solely in crime prévention. 
Both of them are necessary, but not sufficient. Although adding them up is not suffïcient 
either, integrated countermeasures are of the utmost importance in cybercrime prévention. 

In sum, the weak controllability of the Internet poses serious problems that fall into the 
domain of criminal law. There is a necessity for translating traditional law to cyberspace, 
translating domestic law in the international forum, and translating diversified provisions into 
a unified standard. Criminal-law reform is to put an end to the disorder of cyberspace where 
obligations and liabilities hâve not been suffïciently established and perpetrators of offences 
often run large. 

However, we should also notice that the information society is not a new society but a 
new stage of the existing society, a social reality that is being re-expressed in the fonn of a 
re-encoding with a new coding System, as well as a new social order that is re-coping with 
the developmental tendency of society that has emerged in this new fonn. In the re-encoding 
process, the old codes remain or disappear, while the new codes emerge and grow. 
Cybercrime is one code in the re-encoding process of the information society. 
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CHAPTER 4. DEFINITION AND CLASSIFICATION OF CYBERCRIME 


4.1 Introduction 

Chapter 3 gives a detailed description of the vulnerabilities of information Systems to 
potential cybercriminals. Although the pervasive use of information Systems is accompanied 
by a wide range of social problems, and the countermeasures necessitate mobilizing a broad 
variety of legal remedies, the current dissertation will primarily be concentrating on the 
criminal phenomenon accompanying information Systems and on the deterrence framework 
revolving around but not limited to criminal law. Therefore, the main task facing us is to 
detennine the scope of the topic, through defining the subject-matter “cybercrime”. 

Alternative définitions of cybercrime hâve emerged over the years as the users and 
abusers of computers expand into new areas. There is neither a unified définition, nor a 
commonly accepted method of classification. The définition and classification methods are so 
diversified that it is impossible to sketch the scénario of cybercrime by using a single standard 
(Wasik 1991, p. 1). The présent rampancy of cybercrime can in part be understood as the 
product of weak legal deterrence. This chapter advocates the use of a unified broad définition 
of cybercrime, in order to reach a consensus as great as possible, reform both substantive and 
procédural criminal law and provide effective protection for the infonnation society. The 
chapter also proposes to classify cybercrime according to the rôles of information Systems 
into seven categories, information Systems as target, tool, media, route, place, means of crime, 
and used in préparation for further offences. 


4.2 Earlier notions of computer crime 


Before the 1990s, computer crimes were generally understood as offences relating to 
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computers, but there was less connection with networks, even though the perpetrators of 
earlier computer crimes also exploited the networks. Among scholars, the disputes 
concerning the relationship between computer and crime were diverse. Even today, there is 
no apparent distinction between a computer crime and a traditional crime that has some 
factors relating to the computer or the Internet. The situation in the pre-Intemet âge should 
easily be realized from the présent viewpoint. However, the most noteworthy dispute then 
resolved around whether there was a distinct criminal phenomenon of computer crime. 
Roughly, three different standpoints existed. 

From the first standpoint, there was no such thing as computer crime. For example, 
Johnson (1985) insisted that there was no distinction between an offence involving a 
computer and an offence involving no computer. Gotternbarn (1990, pp. 18-24) also claimed 
that a particular category of computer crime was unnecessary. The negativists regarded 
computer crimes as offences belonging to traditional categories. Because murder with a 
wooden stick, a block of stone, a knife, a gun, or a bomb, was only a murder, naturally theft 
by with a bag, a car, or a computer remained just a theft. The “new” types of crimes or new 
forms of existing crimes could, from this standpoint, be covered by traditional criminal law. 
There was, therefore, no need to add new articles to existing law. The only task was to punish 
these crimes according to the old law. 

The second standpoint claimed that the computer could be used to perpetrate every kind 
of crime. It could be considered pan-computer crime view (Nycum 1983, pp. 2-4). According 
to Sterling (1994), Donn B. Parker claimed that “...ail business crime will be computer crime, 
because businesses will do everything through computers. ‘Computer crime’ as a category 
will vanish.” Fi (1993) proposed that computer crime was neither a single offence, nor a 
category of offences; only because the offences more or less related to computer Systems, 
they were called computer crimes. In fact, this terni refers to one kind of computer crime in 
one situation, and referred to one category in other situations (Fi 1993). The computer crime 
thus covered a very broad range of offences. 

Fi (1992) also attempted to apply traditional penal law provisions to various possible 
kinds of computer crimes, in examining the possibility of using the 1979 Penal Faw of China 
to impose a penalty on ail offences involving computers against State security, person, 
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property, and the social order. This kind of proposai was also a universally accepted idea 
about dealing with computer crime in many countries at that time. The evidence was that 
many countries punished the first computer crimes before they implemented their flrst 
computer crime laws. At least in countries where a broad legal interprétation and judicial 
législation were practised, unpunished computer crime cases due to lack of applicable law 
were rare. But the analogous application of law by extending the scope of existing law to 
impose punishment on activities that were not prescribed by law when they were committed 
is prohibited by the principle of legality. The broad interprétation of law did not necessarily, 
however, violate the principle of legality, even if the interprétation incorporated new tenns 
such as the computer, the Internet, and infonnation Systems into law where these terms were 
once absent. The value of this standpoint was to make the potential of traditional criminal law 
as great as possible. Where there is no law ready to combat computer crime, this standpoint 
provides a theoretical basis for the application of existing laws to both protecting society and 
maintaining legality. 

In practice, as Bequai (1978) wrote that, “the majority of our local juridictions rely on 
traditional concepts to deal with this new and growing area of crime” (p. 25), including laws 
dealing with crimes involving habitation and occupation, covering arson and burglary; and 
laws dealing with offences involving property, covering larceny, embezzlement, extortion, 
malicious mischief and forgery (pp. 25-36). Recent efforts for utilizing the functions of 
existing criminal law hâve also been made in Brenner (2001). 

The third standpoint was held by middle-of-the-roaders, who admitted the existence of 
computer crime on the one hand, but limited the range of offences on the other. Undeniably, 
this has been the most broadly accepted theory. According to this theory, different technical 
terms hâve been used to dénoté the phenomenon, different définitions hâve been given to 
describe the issue, and different theoretical achievements hâve been acquired to address the 
legal framework. However, it must clearly be recognized that there has never been a unified 
technical term, a unified définition (UNCJIN 1999, Paragraph 21), or a unified theoretical 
structure of a globally accepted kind. Many technical terms hâve been used 
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interchangeably. 91 Different countries and individuals hâve referred to many définitions. In 
addition, people from different disciplines hâve also developed many theoretical frameworks 
over the years. At présent, when we talk about computer crime, or cybercrime, a direct 
reflection of this is the assumption that computers or networks are involved in this crime. 

Computer crime has been defined in a diverse spectrum of senses, from extremely 
narrow ones to extremely broad ones. The définition in the narrowest sense limits computer 
crime to “one that can be carried out only through the use of computer technology” (Tavani 
2000, pp. 6-7). This définition excludes crimes that can be committed only through other 
means than computer technology and that can be committed in both ways. A broader 
approach defines computer crime as crime by computer. This définition excludes crimes 
targeting a computer. 

A yet broader définition includes both crimes by computer and against the computer. 92 
The current view about offences against computers is likely to relate the physical forms of 
computers or computer technology to the function of computers. There were numerous cases 
in which computers were damaged not by today’s technological methods, such as viruses, 
hacking etc., but were committed by traditional measures, including arson, bombing, and 
shooting. The development of cybercriminal phenomena proves that there is a vague limit 
between offences by computer and offences against the computer. 

The broadest définition was proposed by Parker (1980, cited in Solarz 1981, pp. 25-26), 
who divided computer crimes into computer abuse, computer crime and computer-related 
crime. Obviously, the computer crime conception at the second level was included in the first 
level. The computer crime conception at the first level was extremely broad. In fact, Parker 
and Nycum (1984, p. 313) defined computer crime “as any illégal act where a spécifie 
knowledge of computer technology is essential for its perpétration, investigation, or 
prosecution,” saying subsequently that computer crime was not regarded as a distinct type of 
crime different from other crimes, and that almost every sort of crime could be committed 

91 See COM (2000) 890 final, 12. Even the UN uses the terms computer crime and computer-related 
crime interchangeably. See also United Nations Crime and Justice Information Network (1999), 
Paragraph 21. 

92 See, for example, McConnell International (2000); Reece (2000). See also Berg (2000); Goodman 
(1997), pp. 465,468-469. 
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through the exploitation or intervention of computers (ibid). Such kind of a définition has 
accepted and developed by many subséquent studies, for example, Pihlajamaki (2004) 
defined cybercrime (“information technology crime” in his original term) as a crime in which 
the data processing System is the target or tool, while spécial knowledge of information 
technology is a necessary factor in the process of commission and prosecution (p. 286). 

In the network environment, the model of a computer crime becomes more relevant with 
the emergence of the Internet. Cybercrime is loosely defined as a crime committed by means 
of the computer or the Internet (Levinson 2002, p. 455). The Council of Europe Convention 
on Cybercrime 2001 made the term “cybercrime” prévalent. Articles 2-10 of the Convention 
on Cybercrime also adopted a broad conception in criminalizing cybercrime, providing for 
the offences against security, computer-related offences, and content-related offences. 
Although the Convention adopted a broad conception, the detailed offences under the titles 
were limited. The high level of consensus conceming conception, and the low level of 
consensus concerning the categories is a factor that makes it reluctant for more countries to 
consider access to the treaty. 


4.3 The previous deficiencies in understanding cybercrime 

Some of the previous understanding about cybercrime has been misleading and 
confusing in providing inexact information. The following deficiencies hâve been very 
frequent in both academie writings and non-academie writings. 

The first misunderstanding happened against a historical background. While people hâve 
regarded the predecessors of cybercriminals as the hackers of three or four décades ago, a 
general view has been to make the tenn “hacking” bear the meanings of today’s “cybercrime”. 
This misunderstanding buried the computer explorers collectively under the shell of déviance. 

The increasing cyber perpétration at the end of the twentieth century and the beginning 
of the twenty-first century witnessed a second misunderstanding of the conception. The 
illusion that infonnation Systems were a critical infrastructure that was easily prone to abuse 
and in effect caused massive deaths, injuries, and économie disasters led to an extreme notion 
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that viewed ail cybercrimes as terrorist attacks. The équation “cybercrime = cyber terrorism” 
has already been broadly accepted by many scholars with the help of a non-expertise 
dominated mass media, which survive compétition by spreading both truth and speciousness. 
As yet, although there hâve been many concems about the use of infonnation Systems in the 
préparation of real terrorist attacks, and the situation may be growing worse , 93 cyber 
terrorism is only a political possibility. The crime is the premise of punishment that assumes a 
legal order, but the terrorism is a reason for war that destroys the legal order. By exaggerating 
many traditional crimes as terrorism, the powers can launch continues wars against the 
weaker States, or threaten to do so as politics. By claiming ail cybercrime as cyber terrorism, 
the future of the communities in the information society is obscure. We doubt whether 
hackers deserve punishment by war. The character of such a war would not be its punitive 
nature, but a social collapse. 

The third misunderstanding is politicization of the conception in a broader sense. To 
view cybercrime as cyber terrorism is one part of the picture. This broad misunderstanding 
was created by the acclamation of information Systems as a national critical infrastructure, to 
maintain and protect which the State intervention or political intervention is considered 
necessary. The politicization of infonnation Systems results in the politicization of activities 
against this System, the cybercrime. 

The fourth misleading understanding is, strangely, to moralize the cybercrime by 
exploiting the term “hacking”. The moralization has two respects: one regards cybercrime as 
being moral, not immoral and thus not illégal; the other regards cybercrime as a moral issue, 
not a legal issue, and thus law has no business here. The natural effect is that cybercrime 
should not be regulated by law. 

The last category of misleading définitions has the tendency of mystification. The 
représentative notion is that cybercrime is high-tech crime and does not seem to be 
committable by coinmon users in daily life. Actually, when technology is used in routine life, 

93 Many prosecuted cases involved features that were possibly to be used in terrorist attacks deposited 
in information Systems, for example, R. v. Boutrab ([2005] NICC 36 (24 November 2005)), in which 
the accused downloaded from a library computer and deposited in floppy dises the files, the contents 
of which contained information about the making and use of explosives for attacks on aircraft and the 
manufacture of silencers for firearms. 
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high technology gradually becomes low technology. When high tech crime exists in daily life, 
it becomes low-tech crime. 


4.4 What exactly is cybercrime? 


No uni lied term for cybercriminal phenomena has been universally accepted, even 
though some terms including “computer crime” and “cybercrime” are relatively popular. 
Roughly, seven groups of terms hâve been in use. Among these groups, many different words 
and phrases hâve been adopted or created. Because of the changing ways in which the 
cybercriminals commit crimes, the ways in which people name these crimes are changing as 
well. In order to clarify how people view cybercrime from different standpoints, this section 
examines some groups of synonymous terminologies of “cybercrime”. 

The first group of terms emphasizes the view that regards the computer as a unique target 
or tool of crime. The term “computer crime” has been broadly used in academie writings as 
well as in laws and régulations particularly before the Internet was opened to commercial use 
in the 1990s. This tenn represents a group of similar terms, including computer crime, 94 
crime by computer (Parker 1976), computer-related crime (Sieber 1998; Stephenson 2000), 
computer-facilitated crime, 95 computer misuse, 96 computer abuse, 97 computer mischief, 98 


94 Computer crime is the most frequently used term in denoting the phenomenon. For example, there 
is an institution named the “Computer Crime Research Centre”. See the institution’s Web site, at 
http://www.crime-research.org/. 

95 See Computer Crime and Intellectual Property Section (CCIPS), Prosecuting Crimes Facilitated by 
Computers and by the Internet, last modified 15 March 2007. Retrieved 15 March 2007, from 
http://www.usdoj.gov/criminal/cybercrime/crimes.html. 

96 For example, the usage of this term in “The U. K. Computer Misuse Act 1990 (c. 18).” 

97 For example, the usage of this term in “The US Computer Fraud and Abuse Act (18 USC 1030).” 

9S See, for example, Woodward, C. Washington Quarter Voting Hijacked by Computer Mischief, 
Associate Press, 10 April 2006. Retrieved 15 March 2007, from 
http://seattlepi.nwsource.com/local/6420AP_WA_State_Quarter.html. In unofficial English translation 
(by the Finnish Ministry of Justice) of the Penal Code of Finland, Chapter 34, Section 9a (578/1995) 
defmes criminal computer mischief, stating that “A person who, in order to cause harm to automatic 
data processing or the functioning of a data System or télécommunications System, (1) produces or 
makes available a computer program or set of programming instructions designed to cause harm to 
automatic data processing or the functioning of a data System or télécommunications System or to 
damage the data or software contained in such a System, or distributes such a program or set of 
instructions, or (2) makes available guidelines for the production of a computer program or set of 
programming instructions or distributes such guidelines, shall be sentenced, unless an equally severe 
or more severe penalty for the act is provided elsewhere in the law, for criminal computer mischief to a 
fine or to imprisonment for at most two years.” 
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computer break-in," computer sabotage (Sieber 1996), computer espionage, 100 computer 
manipulation (Sieber 1996), etc. “Comcrime” was used in the title of Sieber (1998), though 
the term was not used in the main body of the text. 

The second group of terms are accompanied with a crime particularly facilitated by 
computer networks. The origin of the term “cybercrime” cannot be identified, but there is no 
doubt that it became prévalent with the legislating process of the European Convention on 
Cybercrime. The prefix “cyber” simply means computer, but people tend to use it in terms of 
networked computers. Generally, people wish to distinguish the criminal phenomena in the 
network âge from that before the 1990s. Smith, Grabosky and Urbas (2004, pp. 5-6) hâve 
argued that "cyber" used as an adjective does not equal to "cyber-" used as a prefix. That is to 
say, "cyber crime" is not "cybercrime". They hâve used the term "cyber crime" "to describe a 
range of criminal offences, only some of which specifically relate to computers and the 
télécommunications infrastructure that supports their use." (p. 5) They hâve viewed 
"cybercrime" as "a singular concept of crime that can encompass new criminal offences 
perpetrated in new ways" and "cyber crime" as "a descriptive term for a type of crime 
involving conventional crimes perpetrated using new technologies." (p. 6) Most authors are 
using these two tenns interchangeably. Besides terms cybercrime, or cyber crime, people also 
use net crime, 101 the Internet crime (Taylor and Quayle 2003), crime on the Internet, 102 
Internet-related crime, 103 network crime, 104 etc. In Finland, cybercrime is sometimes 


99 In unofficial English translation (by the Finnish Ministry of Justice) of the Penal Code of Finland, 
Chapter 34, Section 8 (578/1995) defmes criminal computer mischief, stating that “(1) A person who 
by using an unauthorized access code or by otherwise breaking a protection unlawfully hacks into a 
computer System where data is processed, stored or transmitted electronically or in a corresponding 
technical manner, or into a separately protected part of such a System, shall be sentenced for a 
computer break-in to a fine or to imprisonment for at most one year. (2) A person shall also be 
sentenced for a computer break-in if he, without hacking into the computer System or a part thereof, by 
using a spécial technical device unlawfully obtains information contained in a computer System 
referred to in (1). (3) An attempt is punishable.” 

(4) This section applies only to acts that are not subject to an equally severe or more severe penalty 
provided elsewhere in the law. 

100 Defence Investigation Service, Computer Espionage, The American Report, number 288, 5 May 
1996. Retrieved 15 Mardi 2007, from http://www.kimsoft.com/korea/edispy.htm; McNamara (2003). 

101 For example, the term net crime was used in news report, Luening, E. European Council Moves 
Net Crime Treaty Forward, CNET News, 20 November 2000. Retrieved 15 Mardi 2007, from 
http://news.com.com/2100-1017-248874.html 

102 For example, Darlington, R. Crime on the Internet. Retrieved 15 Mardi 2007, from 
http://www.rogerdarlington.co.uk/crimeonthenet.html 

103 For example, Computer Crime and Intellectual Property Section (CCIPS), How to Report 
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translatée! as “tietoverkkorikos” (information network crime), with the same meaning as 
“tietotekni ikk arikos” (infonnation technique crime), referring to both offences targeting 
information processing Systems and offences committed with the assistance of infonnation 
Processing Systems. 105 According to Darlington (n.d.), crimes on the Internet include 
“hacking, viruses, pirating, illégal trading, firaud, scams, money laundering, prescription drugs, 
defamatory libel, cyber stalking, cyber terrorism.” According to CCIPS (2006), 
Internet-related crimes include “computer intrusion, password trafficking, copyright piracy, 
theft of trade secrets, trademark counterfeiting, counterfeiting of currency, child pomography 
or exploitation, child exploitation and Internet firaud matters that hâve a mail nexus, Internet 
firaud and spam, Internet harassment, Internet bomb threats, trafficking in explosive or 
incendiary devices or firearms over the Internet.” 

The third group of tenns regard the Internet as only a part of the whole 
télécommunications Systems. 106 Electronic crime (e-crime) emphasizes the characteristic of 
the criminal phenomena relating to (micro) electronics rather than to computer or computer 
networks. “The tenn ‘e-crime’ arose in the tradition of terms such as e-mail, e-commerce, 
e-zines, e-tailer and e-government.” 107 With this term, people usually indicate the same 
phenomenon as cybercrime, but others also extend it to cover crimes relating to the 
télécommunications Systems, in which the Internet is only a part of the whole Systems. 

The fourth group of terms regard the space, the community, or the environment created 
by the Internet as the place where a crime is committed. The word “virtual” has a deep and 
different meaning in the term “virtual reality”, 108 but “virtual crime” is in fact the substitute 
of cybercrime in the sense that the crime is committed in the network environment. A purely 


Intemet-Related Crime, Last modified 15 Mardi 2007. Retrieved 15 Mardi 2007, from 
http://www.usdoj.gov/criminal/cybercrime/reporting.htm 

104 In Chinese, the counterpart of the term cybercrime is simply “wangluo fanzui” (network crime). 

105 Governmental Proposai HE 153/2006 of Finland concerning Approval of Council of Europe 
Convention on Cybercrime (here after HE 153/2006), General Justifications, 1. Introduction. 

106 For example Tennyenhuis and Jamieson (2003), pp. 187-206; Australian Police Commissioners’ 
Conférence Electronic Crime Working Party of Australasian Centre for Policing Research (2000), The 
U. S. Technical Working Group for Electronic Crime Scene Investigation (2001), etc. 

107 See McKenizie, S. What are Electronic Crimes? 2 July 2004. Retrieved 15 March 2007, from 
http://www.criminology.unimelb.edu.au/research/ecrime/ecrimedefn.html 

10s Virtual reality indicates an environment produced by a computer that looks and seems real to the 
person experiencing it. See Summers (2003), p. 1841. 
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virtual crime has not been criminalized. 109 When used as synonym for cybercrime, the focus 
of the term “virtual crime” is put into the spécifie spatiotemporal context created by the 
Internet and interpersonal communication via the Internet. 

The fifth group of tenns regard the data, information or privacy as the primary factor in a 
crime. In fact, cybercrime is crime related to information or information Systems (not limited 
to computer and computer networks). Future tenninology should therefore incorporate 
information or infonnation Systems into the name of such a crime. 

The sixth group of terms regard the processing of “digital” information as the unique 
characteristic of cybercrime (Lilley 2002). “Digital” means “using a System in which 
information is recorded or sent out electronically in the fonn of numbers, usually ones and 
zéros.” 110 Digits are neither the System through which the crime is committed, nor the 
technology by which the crime is committed. Rather, they are the fonn in which information 
is processed through the System. A crime can hardly be “digital” because the committing 
process of a crime differs from the processing fonn of information. 

The seventh group of the tenns regard ICT as high technology. A crime involving ICT is 
named high technology crime, 111 high-tech crime, 112 hi-tech crime, 113 or infonnation 
technique crime. 114 In fact, the tenn “high technology” is only used to indicate modem high 
technology, excluding the ancient ones. In the viewpoint of the tenth century, papermaking 


109 Such as the case of “a râpe in cyberspace” described in Dibbell (1993). The article described a 
“cyberrape” performed by a Mr. Bungle in a multi-user dungeon (MUD), called LambdaMoo, and the 
repercussions of his act. See Wikipedia, A Râpe in Cyberspace, 17 April 2006. Retrieved 15 March 
2007, from http://en.wikipedia.org/wiki/A_Rape_in_Cyberspace. 

110 See Summers (2003), p. 436. 

ul Kovacich and Boni (1999); the International High Technology Crime Investigation Association. 
“(HTCIA) is designed to encourage, promote, aid and effect the voluntary interchange of data, 
information, expérience, ideas and knowledge about methods, processes, and techniques relating to 
investigations and security in advanced technologies among its membership.” Retrieved 15 March 
2007, from http://www.htcia.org/aboutus.shtml 

112 For example, an institution named “Australian High Tech Crime Centre”, which “employs 
représentatives from ail Australian State and Territory police forces in both its staff and its Board of 
Management. This créâtes an environment of coopération and national consistency to referrals, 
training, éducation, intelligence, policy and investigations.” See web site, at http://www.ahtcc.gov.au/. 

113 For example, an institution named “The National Hi Tech Crime Unit”, which is part of the Serious 
Organised Crime Agency, see web site, at http://www.nhtcu.org/ 

114 For example, in Finnish, the literal meaning of the term “tietotekniikkarikos” is information 
technique crime. The term is used interchangeably with “tietoverkkorikos” (information network 
crime) (HE 153/2006, General Justifications, 1. Introduction). The general understanding of 
cybercrime is that it happens in the environment of information processing Systems and with an 
expertise on the operation of such Systems (Ibid). 
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may be a high technology. In the viewpoint of fourteenth century, movable type printing 
technique may be another high technology. They can both be regarded as technology relating 
to information processing. This indicates that the term high technology is unsuitable for 
naming a crime. On the other hand, most computer-related crimes hâve in fact only used “low 
tech” as Molnar (1987, p. 714) found in his study. Therefore, there has been a 
misunderstanding in giving the general public the impression that each and every kind of 
computer crime is sophisticated and not committed by ordinary person (ibid). 


4.5 “Cyber” as a label of crime 

As noted, the prevalence of the prefix “cyber” readily becomes a substitute for the terms 
computer and computer network. Anything can be “cyber” if it is related to the computer and 
the computer network. Cybercrime is not always a crime that did not exist in the pre-computer 
era, just as we cannot deny the existence of “ancienf ’ white-collar crime before Sutherland 
coined the term. The twentieth century was the time when people tended to label old or new 
things with new inventions. The most apparent example is the use of the word “modem.” Due 
to the overuse of the word, people today cannot use the word modem any more. Criminal law 
and criminology are also full of labels of this kind. 

One of crime’s labels currently in use is “cyber.” To label a crime “cyber” has a similar 
meaning to labelling the présent historical period as an information âge. In addition, it has a 
further significance in criminology. The following analysis is only an effort to explore the 
subtext to which the prefix “cyber” can refer. 

(1) The label contains the implicit meaning of déviant behaviours dépendent on 
information Systems. Violent crime is a label for déviant behaviours involving the use of 
human force. Intelligent crime is a label for déviant behaviours involving the use of wisdom. 
White-collar crime is a label for déviant behaviours by the perpetrator’s occupation. Similarly, 
cybercrime labels déviant behaviours that dépend on information Systems, without which the 
offences are impossible to commit, or by which the offences may be committed more 
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efficiently. 115 The more the people are heavily dépendent on information Systems, the more 
the offences that cannot be committed without such Systems are committed; the more the 
offences with such a System can be committed more efficiently the more frequently they 
occur. The prefix “cyber” is meant to characterize the dependence of new types or new 
categories of offences on information Systems which label this society. 

(2) The label sketches the semi-virtual and semi-real crime scene. Many people are 
talking about a different space as virtual. In fact, due to technological limits, perfect virtual 
space has not been realized. The current cyberspace is a semi-virtual and semi-real space. 
Thus, pure virtual interaction is neither possible nor has its meaning. The infonnation âge is a 
terni merely symbolizing a developing stage of virtual space, a partly virtual and partly real 
environment. Naturally, cybercrime only involves a semi-virtual and semi-real crime scene. It 
is true that the supposed neural computer may construct a pure virtual atmosphère and 
facilitate a pure virtual crime. However, the virtual crime scene cannot appear before a robot 
driven by a neural computer is created. 

(3) The label gives us an impression of human-machine criminal interactions. 
Human-machine interaction represents only a piece of social interactions. The results of 
human-machine interaction can be human-machine-human or human-machine-machine 
interactions. The process can be unlimitedly expanded. Furthermore, the participants in the 
interaction can be multiple humans and multiple machines, that is, in networked Systems. This 
shows the complicacy of online activities including cybercrime. The expansive forms of 
human (H)-machine (M) interaction can be illustrated as: 


115 There is no a lack of viewpoints that regard computer crime as a kind of white-collar crime. For 
example, Bequai (1978, p. 1) stated: “Computer crime is part of a larger form of criminal activity 
-white-collar crime.” Considering that the concept of white-collar crime is becoming vague in the 
information âge, this study generally does not classify cybercrime into the bigger category of 
white-collar crime. 
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Figure 4 Human-Machine Interaction 

In fact, the human-machine interaction has a deep impact on the criminalization of 
déviant behaviours relating to information Systems. For example, in the Governmental 
Proposai HE 153/2006 (Finland), the spreading of computer virus has been noted as likely to 
be realized through delivering it to other persons, or to be through spreading it in the 
machines. 116 

(4) The label demonstrates on extension of the criminal territory. The traditional crime 
happens in the visible sphere and is mostly territory-dependent. In the infonnation âge, the 
territorial extension of crime has dual meanings. On the one hand, the criminal phenomenon 
extends from the visible sphere to the invisible sphere. Cybercrime generally crosses both 
visible and invisible spheres simultaneously. The process and results of cybercrime are both 
revealed only with diffïculty. On the other hand, trans-territorial crime becomes easy with the 
help of infonnation Systems, as compared with the traditional communications System and 
transportation System. Information Systems integrate the function of many traditional Systems, 

116 HE 153/2006, Detailed Justifications, 3. Reasons of Governmental Bills, 3.2 Penal Code, Chapter 
34 Endangerment. 
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enabling a remote operation of communications, transportation, authentication, banking, 
printing, and so forth. 

(5) The label causes multidisciplinary attention. In the past, scholars attempted to label ail 
those disciplines relating to crime by the term “criminal” and formed many marginal 
disciplines, such as criminal psychology, criminal sociology, etc. The twentieth century 
development of criminal phenomena made it overcomplicated to create so many disciplines. 
Rather than labelling informatics, cybemetics, etc., “criminal”, scholars from different 
disciplines pursue research from their own standpoints. Works of many disciplines 
accommodate the contents of cyber ethics and cybercrime as inseparably constituent. Crime 
and its study are both more “cyber” than “criminal”. Many criminalists migrated from the 
criminal sciences to other disciplines before the information âge. Today, more 
non-criminalists are migrating from their own disciplines to the criminal sciences. 

(6) The label holds the digital criminal power. While information Systems utilize the 
power of the digital fonn, crime is also becoming digital. “Being digital” 117 means “being 
different” from the traditional social life. “Being digital” also means complexity and 
advancement of criminal circumstances. The power of infonnation is expressed in digital 
fonn, both in social welfare and in social problems. It is natural for criminals to exploit the 
digital power of the scientific and technological advancement. In fact, the criminal 
phenomenon of the présent day is modernized by the label of “being digital” in its 
spatiotemporal existence, with the emergence of new types of offences and new forms of old 
offences. 

(7) The label does not disrupt the vitality and continuity of the criminal tradition. 
Aggressive activities are universally acknowledged among animais. Crime is as old as human 
beings, finally imposed punishment by law. The corner-stones of criminal science are 
offences such as homicide, theft, robbery, arson, etc. The development of criminal 
phenomena demonstrates the continuity of tradition and the révision of minor details, 
including the tools used, the vehicle driven, the assets obtained or the premises destroyed. 
However, with interests and security as the basic goals, the foundation of criminal phenomena 

117 “Being digital” cornes from the name of a book by Nicholas Negroponte (1995), who put forward 
a future vision of digital technology. 
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has not changed. Labelling a crime “cyber” is merely adding new factors to the tradition, but 
not undennining the innate foundation. With this label, traditional criminal law just takes a 
new step forward. 

(8) The label conlirms the transformation of criminal patterns. If we say that the 
traditional criminal phenomenon was symbolized by forces and violence, the characteristic of 
cybercrime is the involvement of intelligence and intrigue. The physical and psychological 
existence of past human beings was confronted by threats of starting a bloody scene. Even in 
the présent day, terrorist attacks are far more often the primary headlines in the mass media 
and a theme of critical concem for governments. For example, approximately 11,111 terrorist 
attacks occurred in 2005 and resulted in over 14,602 killed, 24,705 injured, and 34,780 
kidnaps. Approximately 630 attacks accounted for over half of the total fatalities. 118 The 
bloody scene remains a severe threat, but a silent transformation of this threat is happening 
with the continuing growth of information Systems. Certainly, there is no sign demonstrating 
that the traditional fatal violence can be replaced by cybercrime or cyber terrorism. 
Cybercrime represents merely a tip of the iceberg of the entire crime scene. We still doubt 
whether the hacker will be the future captor or killer? 


4.6 Towards a broad définition of cybercrime 

Considering the previous expériences and lessons in législation and law enforcement, I 
strongly advocate a broad définition of cybercrime, which would then hâve a number of 
advantages in criminal-law reform. 

First, a broad définition of cybercrime would help to achieve as great a consensus as 
possible in the context of criminal-law reform. International negotiation is a prolonged and 
expensive process, a consensus based on a narrow définition would not be as effective as one 
based on a broad définition. Criminal justice according to a less consentient mechanism will 
inevitably meet unsolvable difficulties that require a new round of international consultation. 
Considering that current international consensus is inadéquate, supplementary agreement is 

118 The U. S. Department of State, Country Reports on Terrorism, 2006, Statistical Annex, v and vi. 
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necessitated in the near future to acquire a broader coverage. An international treaty should 
be based on such a broad définition that member States would only exclude by way of 
réservations clauses unsuitable according to their own needs and traditions, but not exclude 
such contents from the treaty and hinder other State from accepting these clauses. 

Secondly, a broad définition would help to revise criminal law completely, thus 
avoiding merely adding siinply a couple of isolated articles. The isolated articles leave the 
cybercrimes in the broad sense unpunishable according to laws. The broader the coverage of 
the définition is, the more possible it is for criminal laws to prescribe more activities as 
falling under the category. Many countries, including China and the U. S., initially passed 
laws with very limited coverage over activities or targets; however, they ail subsequently 
made amendment so as to expand the scope of their législation. Starting from a broad 
définition will avoid the waste of legislative resources. 

Thirdly, a broad définition would help to amend procédural criminal law based on 
substantive criminal law. Without a qualified procédural law, the amendment of substantive 
law is easily invalidated. In the common-law System, the division between procédural law 
and substantive law is not so clear. Nevertheless, in other legal Systems, the coordination of 
these two branches of law has sometimes required a spécial legislative process. The prior 
enactment of substantive law is reasonable before procédural law. For both the substantive 
and procédural laws to be more effective and more Consolidated, a broad définition of 
cybercrime would enable a better drafting of provisions in procédural law. 

Finally, a broad définition would also help to provide full protection for a critical 
information infrastructure. Legal science should always face the social changes that are 
seeking to influence legal notions and the legal framework. However, social changes hâve 
never happened so rapidly in the history they do as today. The development of cybercriminal 
phenomena is a particular example that must be considered from the global view. In less 
developed or less rapidly developing countries, their laws cannot wait for the occurrence of 
cybercrimes within their own boundaries. Every offence existing in other countries may cross 
the borderless networks without perception. 
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4.7 Proposed définition of cybercrime 


In this dissertation, cybercrime is defined as any type or any form of traditional or 
untraditional crime involving information Systems in use as media, means, place, route, target, 
tool, or used in the préparation for other crimes. 

First, cybercrime covers any form of traditional or any type of untraditional crime that 
can involve infonnation Systems. With the universal use of infonnation Systems, many types 
of new crimes emerge, many old crimes occur in new forms, and many new and old crimes 
happen interlinked. If information Systems are the key factors in the crime, the crime falls 
into cybercrime. If an offence cannot be committed through information Systems, it is not a 
cybercrime. According to the relationship between the cybercrimes and traditional crimes, 
cybercrimes can be divided into cybercrimes as substitutes for traditional crimes and 
cybercrimes as the compléments of traditional crimes. The occurrence and increase of 
substitutes dépend on the costs compared with the traditional crimes. When the costs of 
cybercrimes are lower than traditional crimes, cybercrimes will increase, vice versa. The 
occurrence and increase of compléments, nevertheless, dépend on the costs when compared 
with traditional crimes committed by other means. When costs of traditional crimes 
committed by the means of computers and networks are lower, crimes of this kind will 
increase, vice versa. In this sense, cybercrimes turn out to be traditional crimes facilitated by 
computers and networks. 

Second, information Systems are the distinct factor in cybercrime. Li (1993) proposed 
that a computer crime should be defined as a crime relating to “computer information 
Systems”. Computer crime, or cybercrime, is by its nature information crime. The définition 
of cybercrime must contain the element of digital information or be a part of information 
Systems. But computers and networks are siinply the présent représentative of information 
Systems to create, process, transmit, duplicate, exchange, disseminate, modify and destruct 
digital infonnation. The hardware, software, and peripheral devices are only parts of these 
information Systems. The development of ICT may simply outgrow the Systems’ current 
forms. Whatever the forms we use, however, such a mechanism as information Systems will 
remain. 
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The tenns “computer” or “network” cannot embody the complété scene of information 
Systems, nor be expected to point out necessarily to the future of the technology. Many of the 
previous définitions focused on “computer”; and later définitions emphasized “network” as 
well. However, the image of computers and networks is changing; the transformation in the 
future may be faster and greater. It is reasonable to incorporate the term of “information 
Systems” into the définition of cybercrime instead of using the tenns of “computer” or 
“network”. 

Thirdly, information Systems must be in use. Information Systems not in use cannot 
facilitate a cybercrime. The term “in use” has to be understood in a broad sense. A computer 
is in use from the time it is purchased as a facility until the time when it is disused and 
disposed as cast-off. The transportation, installation, debugging, examination, réparation, and 
temporary switching off do not cancel the status of being in use. A paid order is enough to 
make a computer in use, because the expected use will influence the decision-making and 
productivity of the user. If such a computer were to be damaged and the schedule of adopting 
such a device delayed, or the expected benefit reduced, the loss of the user would be apparent. 
A network in use also has a similar meaning. Different stages in the whole process of being 
in use hâve a similar sense but are different in importance. 

In some cases, however, computers are no more than entertainment equipment in a 
victim’s daily life. Where this is the case, the function of the infonnation processing of the 
computer is not particularly emphasized. Then, even if the computer is quite valuable, theft 
or destruction of it should not be regarded as a cybercrime. In KKO:2000:17, the accused, 
who was invited to the victim’s house, took the victim’s portable computer and other devices 
after the victim fell asleep. In I-SHO 13.11.2006 1401, the accused usurped a portable 
computer valued at 880 euros from a shop and sold it to a man at the price of 70 euros, for he 
regarded it as a typewriter. Although the movable property was valuable, nothing about the 
spécial function of the computers was mentioned in the courts. It is apparent that the offence 
was not committed against information Systems “in use” for the purpose of information 
Processing, and the loss was of such a nature as to be neglected compared with the value of 
the computers as commodities. 

Fourthly, the rôles of information Systems in cybercrime are multiple. Information 
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Systems can be exploited as media, means, place, route, target, tool of a crime, or used in the 
préparation for other crimes. Exactly as explosives are different from primitive weapons, a 
plane different from other vehicles, infonnation Systems are different from many traditional 
facilities. The accompanying conceptions are data processing and transmission, multimedia, 
Virtual reality, remote control, online interactive, and so forth. With information Systems, 
people are involved in intersensory actions. To highly evaluate the functions of the (current 
and future) information Systems is a matter that cannot be overestimated. The équivalent 
applies to the situation of cybercrime, which is committed intersensorily. 

Finally, it is also necessary to point out that, even if we adopt a broad définition of 
cybercrime, the offences merely involving infonnation Systems but having nothing to do with 
their functions do not constitute cybercrime. A typical example is the prohibition of import or 
export of computers, software, or technology. Many countries hâve trade prohibitions of this 
kind so as to maintain the political, military, or scientific compétitive priority, and this might 
mean even limiting the public from using such devices. For example, according to the 
Myanmar Computer Science Development Faw of 1996, the importing or keeping in 
possession or utilizing any type of computer, or setting up a computer network or connecting 
a link inside the computer network, without prior sanction, are offences punishable by 
imprisonment of 7 to 15 years and a fine. Offences of this kind do not belong to cybercrime 
in terms of this dissertation. 


4.8 Categories of cybercrime 

Cybercrimes can be classified under different définitions and according to different 
standards. Scholars hâve proposed numerous plans for categorizing cybercrimes. For 
example, Bequai (1979a, pp. 106-107), who originally regarded cybercrime as part of 
white-collar crime, proposed to classify computer crime into five categories, including 
vandalism, theft of information, theft of services, theft of merchandize or other property, and 
firaud. Bequai (1983) thereafter developed his classification into seven categories, including 
Financial thefts, frauds, and abuses; thefts of property; abuses of data; unauthorized use of 
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services; vandalism; sabotage, and political and industrial espionage (pp. 17-21). Wasik 
(1991, pp. 41-60) proposed six categories of computer misuse, including unauthorized access, 
computer fraud, unauthorized removal of data or programmes, unauthorized use of computer 
time or facility, and destruction and damage. Wasik (1991, pp. 24-33) put forward three 
levels of relationships between the conceptions of computer crime and white-collar crime: (1) 
corporate crime, (2) occupational crime, and (3) misuse committed by outsiders. To a certain 
extent, this can also be regarded as a classification System. Grabosky (2000) considered nine 
varieties of cybercrime, including theft of services, communications in furtherance of 
criminal conspiracies, information piracy and forgery, the dissémination of offensive 
materials (including extortion threats), electronic money laundering; electronic vandalism 
and terrorism; telemarketing fraud, illégal interception, and electronic funds transfer fraud 
(pp. 3-8). Icove and co workers (1995), Sieber (1996), and many other scholars hâve also 
proposed various methods of classification. An exhaustive bibliography is neither necessary 
nor possible. However, this section will présent a classification method according to the rôles 
that infonnation Systems play in offences. 

Many earlier définitions of computer crime hâve already contained some methods of 
classification based on the different rôles of the computer in offences. The development 
process is from simple categories to complex categories. The earliest définition contained the 
only category, that is, crime by computer (for example Parker 1976). A subséquent définition 
contained two categories, that is, crime by computer and crime against the computer. 119 
MacKinnon (1997) classified cybercrime into computer-incidental crimes and 
computer-instrumental crimes, and defined computer-incidental crimes as offences in which 
the computers are merely used “incidentally or tangentially”; computer-instrumental crimes 
involve computers more “directly” as the “tool” or instrument (MacKinnon 1997, p. 210). 
The U. S. Department of Justice (2000) categorized computer crime into crimes in which 
computers are targets, storage devices, and communications tools. Parker and Nycum (1984, 
pp. 313-314) identified four ways of committing criminal acts with computers, that is, the 

119 In the network environment, scholars hâve also transplanted this category in their research on 
cybercrime. Casey (2000), as cited in Levinson (2002), p. 455, saying that cybercrime can be a 
traditional crime that is committed through the use of a computer or the Internet, or a crime that 
involves particularly the targeting of computer technology. 
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computer as the object, subject, tool of the crime, and the Symbol of the computer used in 
intimidation or déception. Carter (1995) divided computer crimes into four categories, 
including offences in which the computer was the target; the computer was the instrument of 
the crime; the computer was incidental to other crimes; and crimes associated with the 
prevalence of computers. Whereas information Systems play an increasingly essential rôle in 
contemporary society, considering that the offences accompanied by information Systems are 
being increasingly diversified, we feel that there is a need to expand the categories of 
cybercrime with regard to infonnation Systems. In discussing digital extortion, Grabosky 
(2000) has listed the rôles of infonnation Systems as media for threat, targets of threatened 
action, media for disclosure of embarrassing personal details, means of facilitating payment, 
and incidental to the offence (pp. 34-50). Ail these discussions prove that information 
Systems can play a variety of rôles in offences. 

In the following sections, I will expand the rôles of information Systems in cybercrime 
and divide cybercrime into seven categories. Information Systems can be target, tool, media, 
route, place, and means of crimes and can be used in préparation for other offences. In 
previous literature, the dichotomy recognized the rôles of infonnation Systems used to be 
summarized as target and tool (or tenned instrumentality). The term “tool” or 
“instrumentality” has been used in an unlimited broad way. In practice, the rôles that 
information Systems can play are far more abundant than merely being a tool or an 
instrumentality. 


4.8.1 Information Systems as a target of the offence 

“Computers are targets” is a subtitle in Bequai (1983, pp. 7-11). At présent, we can 
roughly assert that the whole information Systems are targets. In a certain sense, information 
Systems can be regarded as networked assets (Wells and Sevilla 2003), including tangible 
assets and intangible assets, hardware and software, intra-national assets and international 
assets. Networked assets are a kind of combinative assets existing in cyberspace. Furthermore, 
networked assets are dynamic, existing in the process of production, which constitutes a kind 
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of production management, for example, covering activities that can be included in the field 
of electronic commerce. 

The economy, national security, politics, military affairs, science and technology, 
éducation and medicine increasingly dépend on the Internet, through which information is 
created, stored, transmitted and processed. When information security is threatened, the 
whole country will suffer great losses. 

The Internet is vulnérable to artifïcial attacks, some of which belong to traditional 
crimes, for example, cutting off the electricity supply, destroying cables, moving antennae 
used in satellite communications; and more traditional crimes, for example, destruction of 
computers and peripheral facilities. 120 Nowadays, these actions are not unifonnly regarded as 
cybercrime. Cybercrime against the Internet mainly exploits computer technology. The most 
typical attacks are through computer viruses and other malicious programmes. There has 
already been a long list of instances of serious viruses. 

In fact, sometimes computers and networks hâve the nature of both instrument and 
target. For example, an attack on the Internet must be launched through the Internet itself. As 
mentioned above, these classifications are not mutually exclusive. Rather, they can be carried 
out in a compatible way. The perpetrator’s Internet resources are more likely to be used as 
instruments, while that of the others are more likely to be aimed at as targets. The Internet is, 
however, composed of huge indivisible Systems that can be both exploited or attacked. 

I should also emphasize that, “the stealing of computers, computer chips and other 
computer equipments from commercial premises” as in R. v. Kehoe and Others, 121 might 
seem not so relevant to our discussion at first glance. However, a natural resuit of these 
activities is that a computer-aided business and computer-processed data may be damaged, 
and thus it remains a cybercrime in our sense. Taking into account the disabling of the 
functioning of whole information Systems, and the loss of information in internai memory 
media, thefts of computers and their parts represent more than illégal access to the Systems 

120 These were regarded as computer crimes in books published several years ago. For example, Icove 
and co-workers (1995), saying that “Terrorist bombings on buildings housing computer equipment, 
arson, and theft and destruction of computer equipment fall into this category.” 

121 It has been dubbed a “highly sophisticated and successful criminal enterprise,” what one of the 
perpetrators confessed as that “Computer crime is what I do.” [1998] EWCA Crim 1163 (l st April, 
1998). See also Section 6.3. 
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and information. For instance, in Investigation into Security of Personal Information Held by 
Vancouver Coastal Health Authority’s Employée and Family Assistance Programme, the thief 
stole firom the office of manager of the administration a desktop computer containing a 
database of approximately 11,000 clients. 122 

A different situation appeared in R. v. Moseley, 123 where the victim was robbed of 
property, including “computer and electrical equipment, a rucksack and a personal organiser, 
and cash cards.” In THO:2005:28, two portable computers were found at the accused’s two 
résidences. The charge and the conviction against the perpetrator mentioned nothing about 
the particularity of the computer and the information inside it. The computer here is nothing 
more than a target of traditional robbery—no infonnation Systems were interrupted, and no 
information was destroyed or disclosed. 

In addition, the term information Systems is used here in a broad sense as referring to 
information Systems and the infonnation in them. In practice, these two conceptions are 
usually used separately. For example, in the U. K., the Computer Misuse Act 1990 has been 
assigned the principal function of defending the integrity of the Systems but not of 
information, while the latter task falls on the Data Protection Act 1984. 124 

Offences in which information Systems are targeted roughly cover: 

1. Unauthorized access to information Systems, 125 

2. Unauthorized access to information, 126 


122 Investigation into Security of Personal Information Held by Vancouver Coastal Health Authority's 
Employée and Family Assistance Program, Re, 2006 CanLII 20511 (BC I.P.C.). 

123 [1999] EWCACrim 1089 (21 st April, 1999). 

124 DPP v. Bignall [1997] EWHC Admin 476 (16 May 1997) 

125 This has been criminalized by Convention on Cybercrime, Article 2; the Danish Penal Code Article 
263, Section 2; the Finnish Penal Code Article 28; the Swedish Penal Code, Chapter 4, Section 9c. In 
United States v. Sablan (Ninth Circuit No. 94-10533, D. C. No. CR-94-00017-JSU, 7 August 1996), 
the accused has recently been dismissed from a bank. After some drinking, she used a key she had kept 
and went to her former work site, where she used an old password to log into the bank’s computer, 
modified or deleted several files, and then logged off. 

126 In legal instruments, illégal access to information System and illégal access to the information in 
the System are usually linked together, neglecting their obvious différence. In the Convention on 
Cybercrime, Article 2, illégal access to information was the purpose of illégal access to an information 
System. A similar provision is seen in the Danish Penal Code Article 263, Section 2. the Finnish Penal 
Code distinguishes between these two acts, dealing with illégal access to information in Article 38. 
See also the Swedish Penal Code, Chapter 4, Section 9a. In United States v. Czubinski (First Circuit 
No. 96-1317, 21 February 1997), the court reversed the original conviction, which was based on the 
accused's “unauthorized browsing of taxpayer files” with his valid password, even though he was 
required to access only accounts needed to accomplish his official duties. 
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3. Unauthorized alteration of information, 127 

4. Unauthorized interruption of information Systems, 128 

5. Attack by viruses, worms, logic bomb, Trojan horse, and other malicious 
programmes, 12 

6. Theft of computer time, network time, or télécommunications services, a spécifie 
form of illégal access, 

7. Possession, disclosure and providing unauthorized persons with unauthorized 
information; or unauthorized possession, disclosure and providing unauthorized persons with 
information, both being the extension of illégal access to information. 130 

8. Unauthorized interception of communications. 131 


4.8.2 Information Systems as a tool of the offence 


The offences in which computers and networks are utilized as tools hâve the longest 
history in computer crime (Parker 1976; Bequai 1978). Networks are widely interconnected 
outside the limits of time and the boundary of space. As society is becoming more dépendent 


127 Convention on Cybercrime, Article 4, providing computer-related fraud through inputting, altering, 
deleting or suppressing computer data, interfering with the functioning of the computer System. It 
covers both alteration of information and influence on the information System. See also the Danish 
Penal Code, Article 291; the Finnish Penal Code, Articles 33 and 35; the Swedish Penal Code, Chapter 
12, and when the acts involve public danger, Chapter 13, Sections 4 and 5. In United States v. 
Magnuson (Fourth Circuit No. 964957, D. C. No. CR-96-186-A, 24 June 1997), the accused used his 
home computer to intrude into and disable the victim’s computer servers in seven States. 

128 Convention on Cybercrime, Article 5. See also the Danish Penal Code, Article 193; the Finnish 
Penal Code, Article 35; the Swedish Penal Code, Chapter 12, and when the acts involve public danger, 
Chapter 13, Section 4 and 5. 

129 Convention on Cybercrime, Article 6. See also Danish Penal Code, Articles 193 and 291; Finnish 
Penal Code, Articles 33 and 35; Swedish Penal Code, Chapter 12, and when the acts involve public 
danger, Chapter 13, Sections 4 and 5. In United States v. Sullivan, (Fourth Circuit No. 01-4330, 25 
January 2002), the perpetrator planted a logic bomb into the software prepared for the company before 
he quit. Four months later, the logic bomb disabled hundreds of hand-held computers used by the 
company's sales représentatives to communicate with headquarters. 

130 In the United Sates v. Pitts (Fourth Circuit No. 97-4616, 28 January 1999), the accused, who "was 
trusted with access to very sensitive and highly classified materials related to counterintelligence 
operations, surveillance of Soviet officiais assigned to the United Nations, and the true identities of 
American agents and Soviet defectors", "attempted to provide or made préparations to provide his 
undercover FBI handlers with computer diskettes containing information classified as 'Secret'..." 

131 Convention on Cybercrime, Article 3. See also the Danish Penal Code, Article 263; the Finnish 
Penal Code, Article 38; the Swedish Penal Code, Chapter 4, Section 8. 
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upon computer data processing and the télécommunications Systems. With the Internet, 
crackers intrude into others’ computers, web sites, e-mail accounts of individual and 
organizational users whose data, secrets, privacy and electronic property are stored there. 

Under these circumstances, the Internet is becoming the instrument by which 
perpetrators commit not only traditional crimes but also new crimes. It is not only the 
instrument by which people commit crimes, but also the instrument through which people are 
victimized. In using the Internet, some people unwittingly break the law, while others are 
unwittingly hanned by crimes. Definitely, under more circumstances, perpetrators 
intentionally use the Internet to commit criminal acts. Therefore, the crackers who intrude 
into others’ cyberspace through wired or wireless connections to the Internet are violating 
others’ privacy, plundering others’ data, stealing others’ secret information, and embezzling 
others’ property. 

This kind of cyber instrument contains both the similarities and the différences firom the 
traditional instruments. The case where one opens others’ e-mails by a password, then marks 
it as unread and exits, is comparable to the case where someone opens one of the letters of 
another with a knife, and then seals it with glue. They both constitute an infringement of 
freedom of correspondence, but the concept of instrumentality is different. The instrument of 
the Internet bears with it the characteristic of a remote control, in which the criminal is not 
necessarily présent in person at the crime scene where the letters exist, and does not 
necessarily leave footprints or fingerprints. The traditional notion of crime scene also changes 
because of this instrument. 

Offences in which information Systems are used as tools roughly cover: 

1. Forgery and counterfeiting, 132 


132 The Convention on Cybercrime spécifiés the criminalization of computer-related forgery, as an act 
committed through inputting, altering, deleting, or suppressing data. In the national domain, these 
crimes induce no obstacle to applying traditional law, for example, the Finnish Penal Code, Article 33 
can be applied to computer-related forgery. For example, in R. v. Lloyd ([1996] EWCA Crim 1744 
(17 December 1996)), the accused was found using a computer with programmes for manufacturing 
compact dises , a compact writer and blank compact dises to replicate computer programmes. In R. v. 
Boutrab ([2005] NICC 36 (24 November 2005)), the accused used a false passport with the intent of 
inducing an employée to accept it. In R. v. Adeoye & Anor ([1997] EWCA Crim 1343 (3 June 1997)), 
the perpetrator used computer programmes to produce crédit cards from plastic blanks. In search, “the 
police found a printout containing 10,000 credit-card numbers produced by a computer programme.” 
In RovHO 12.06.2001 335, the three suspects, with the assistance of the computer, forged identity 
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2. Computer-aided unauthorized copy of software and other copyrighted works, 133 

3. Télécommunication piracy, 134 

4. Fraud using information Systems, 135 

5. Password sniffering and keylogging. 136 


4.8.3 Information Systems as a medium for the offence 


As a form of media, computer networks hâve their advantages over the traditional media. 
They surpass the limits of time and space, languages and traffic, and political and legal 
boundaries. The Internet enables people to “upload, post, e-mail, transmit or otherwise make 
available content that is unlawful, harmful, threatening, abusive, harassing, tortuous, 
defamatory, vulgar, obscene, libellous, invasive of another's privacy, hateful, or racially, 
ethnically or otherwise objectionable.” In fact, racist speech, tutorials for killing, raping, 
arson, bomb-making and even instructions for virus creating, malicious programme writing, 
and other forms of cyber attacks are widespread on the Internet. Various degree of political 


cards used for the unauthorized users to watch télévision programmes transmitted by a company. 

133 See for example, R. v. Johnstone ([2003] UKHL 28 (22 May 2003)), in which the accused pirated 
recordings and made compact dises and audio cassettes. In THO:2006:6, the accused was said to hâve 
made, without the permission of the right holder, 381 karaoké CDs in order to make a profit through 
using them in the karaoké business. In KouHO:2005:ll, the co-defendants cooperated to make and 
sell DVD copies without the permission of the right holders. 

lj4 In United States v. Clayton (Ninth Circuit No. 96-10127, il March 1997), "cloning" was practised 
by the perpetrator to replicate the stolen identification numbers of legal mobile phones with the help of 
computer software; they were then used to make calls at the expense of the owner of the legal phone. 
See also United States v. Cabrera (Eleventh Circuit Nos. 98-4432, 98-4434, D .C. Nos. 
96-CR-562-DLG, 98-CR-77-DLG, 19 April 1999), where the accused used a small device named 
“copy-cat” to clone cellular phone. 

Ij5 In R. v. Russell ([2001] NICA 45 (12 October 2001)), the accused used a computer identification 
number and password to access confidential files in the computer System, identifying persons that he 
considered likely to claim any type of benefit, and gathering names, addresses and national insurance 
numbers. After this, he passed the information to a co-offender to make false daims for fraudulent 
benefits. In R. v. Farkas (2006 ONCJ 121, 10 April 2006), the accused made a profit of 45,000 dollars 
from victims in the U. S., Canada, and England through fraudulently acquiring goods and fraudulently 
selling them over a period of 18 months via the Internet purchasing and auction. During the fraud, he 
obtained credit-card information through on-line chat groups and bulletin-board Systems. He sold 
these goods to legal collectors, during which he received money but did not send the goods to the 
purchasers. 

136 In United States v. Ropp (C. D. California, 7 October 2004), the accused placed a keylogging 
device on the cable that connected the victim’s keyboard to her computer's central processing unit, 
recording and storing what the victim typed with the keyboard. The indictment was dismissed, but the 
court made it clear how keylogging works. 

L ' 7 See Yahoo! Terms of Service. Retrieved 15 March 2007, from http://docs.yahoo.com/info/terms/ 
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incitement, libel, rumour and superstition crowd up to mislead the public, going even further 
than the traditional media. Many countries are confronted with web sites managed by 
separatists, dissidents, and international opposition forces. These web sites always publish 
their opinions that are harmful to their government but bénéficiai to themselves. Now, 
information of this kind is being practically exported and imported across national borders at 
the speed of light. 

One of the notable problems is slander, the false statements that corne across the 
innovative online media injuring others’ réputations by publishing false statements. The 
forms of such slander mainly include impersonating others to solicit sex mates, one-night 
lovers, publicizing others’ téléphoné numbers, and fabricating photos by inserting the photos 
of other persons into pornographie photos, etc. 

In addition, the online content may cause an international concern, such as racist and 
xénophobie material, that is, “any written material, any image or any other représentation of 
ideas or théories, which advocates, promûtes or incites hatred, discrimination or violence, 
against any individual or group of individuals, based on race, colour, descent or national or 
ethnie origin, as well as religion if used as a pretext for any of these factors.” 138 

Offences in which information Systems act as media roughly cover: 

1. Dissémination of obscene material, in particular child pornography, 139 

2. Dissémination of racist and xénophobie material through computer Systems, 140 


ljS Additional Protocol to the Convention on Cybercrime Concerning the Criminalization of Acts of a 
Racist and Xenophobia Nature Committed through Computer Systems, Strasbourg, 7 November 2002, 
Article 2. 

139 In United States v. Slanina (First Circuit, No. 00-20926, 12 February 2002), the accused was 
convicted of using a city computer to access newsgroups and download pictures of child pornography. 
In R. v. Kozun (2007 MBPC 7), the accused distributed child pornography through his own personal 
computer, in which a programme converted the computer into an automated trading centre on the 
networks. The police found 3522 files (3368 pictures and 154 movies) in his computer that could be 
considered as child pornography and available for trade. The age-range of the children involved was 
between 8 months and 14 years. In Alan Joseph Ogilvie v. Her Majesty’s Advocate [2001] ScotHC 69 
(27th July, 2001), the accused downloaded from the Internet 12,000 images of child pornography onto 
his first computer and upon its confiscation, he downloaded a further 10,000 images of the same 
nature into his newly-bought second computer. In the Convention on Cybercrime, Article 9 
criminalizes offences related to child pornography. 

140 In the Additional Protocol to the Convention on Cybercrime, Concerning the Criminalization of 
Acts of a Racist and Xénophobie Nature Committed through Computer Systems (2003), Article 3 
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3. Online false statement about individuals or corporations, 141 

4. Indécent exposure, 142 

5. False advertising, 

6. Disclosure of confidential information. 143 


4.8.4 Information Systems as a route to the offence 


Cybercriminals can launch attacks firom any computer in different jurisdictions. The 
continued development of techniques and skills for attacks makes it more difficult and 
complicated to investigate and prosecute these crimes (McConnell International 2000, pp. 
1-2). Information Systems can be used to transmit various malicious programmes that hâve 
the capacity to disrupt, destroy or limit the functions of information Systems. For crackers, 
using software tools installed on a computer in a remote location, can illegally access to 
computer Systems to obtain data, plant viruses or Trojan horses, or cause less serious mischief 
by changing user names or passwords. As to spies, corporations and govemments are 
committing espionage through the superhighway of the world’s Internet. Espionage can 
penetrate the best security Systems and the highest levels of management in cyberspace. 


criminalizes dissémination of racist and xénophobie material through computer Systems, Article 4 
criminalizes racist and xénophobie motivated threat, Article 5 criminalizes racist and xénophobie 
motivated insult, Article 6 criminalizes déniai, gross minimization, approval or justification of 
génocide or crimes against humanity, and Article 7 criminalizes aiding and abetting. 

141 Defamation, including libel and slander, can be dealt with either civilly or criminally, in different 
jurisdictions. In the U. K., many cases hâve been settled in civil actions, for example, Godfrey v. 
Démon Internet Limited [1999] EWHC QB 244 (26th March, 1999) , where the accused party hosting 
a newsgroup in the U. S. published a piece that was “squalid, obscene and defamatory of ’ the victim; 
Robertson v. Newquest (Sunday Herald) Ltd & Ors [2006] ScotCS CSOH 97 (28 June 2006), where 
the défendant, a newspaper, which had an online édition, in which a notice was considered of a 
defamatory nature by the plaintiff was posted by a member of public; in Turner v News Group 
Newspapers Ltd. & Anor [2005] EWHC 892 (QB) (12 May 2005), the co-defendants, including one of 
the victim’s former wives and a newspaper published an article on how the victim pursued sex with 
strangers in both printed and online forms. 

142 In Robertson v. Her Majesty's Advocate ([2004] ScotHC 11 (17 February 2004)), the perpetrator 
induced a seven year old girl to dance naked in front of a webcam and lick her private parts in front of 
said webcam, inter alla (paragraph 9). 

143 In Edward Yearly v. Crown Prosecution Service ([1997] EWHC Admin 308 21 March 1997), the 
perpetrator published confidential information that he obtained by unauthorized access. There hâve 
been numerous cases of such a nature in recent years in the U.K., for example, Grimm (2005, p. 598) 
reported that 140 applications for the National Institutes of Health (NIH) grant had been leaked on to 
open access web pages. 
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Pirates, in their turn, can perfectly reproduce and easily disseminate text, audio, video or 
multimedia works by using digital technology (Grabosky 2000, p. 8). Some web sites are 
devoted to “charities” of this kind, similar to providing relief for the poor, who cannot afiford 
expensive software, and thus the market of piracy acts as a solution to satisfy these users. The 
Internet has increasingly been exploited to distribute pirated works, with the development of 
new file-sharing techniques. 

In the case of illégal access to others’ web sites, the intruders may view no document, 
but usually view encrypted or unencrypted documents, obtain documents, read or delete 
e-mails, reveal documents to others, destroy files and make the Systems inopérable, or use 
others’ accounts to connect with the Internet. The attacks on web sites are growing in 
intensity. According to the data of the previous Alldas web site, forty-seven attackers defaced 
72 web sites in 1998, about 430 attackers defaced 1,079 web sites in 1999, about 2,555 
attackers defaced 4,394 web sites in 2000, and in the first quarter of 2001, about 667 attackers 
defaced 4,797 web sites, a number greater than the victimized web sites of the previous year. 
Among these cases, the first 15 attackers who defaced at least one percent of the defaced web 
sites, did one-third of the defacement. The first eight top domain naines of the mostly defaced 
web sites were: “.corn,” “.br”, “.net”, “.en”, “.tw”, “.org”, “.edu”, and “.us”. 144 Although the 
similar source is at présent unavailable and several years has passed, this old infonnation 
indicates that the web sites in the Asian Pacific région rather than Europe are the most likely 
to be defaced. 

The computer Systems of national defence of various countries are also the primary 
targets for hackers. In some cases, the passwords of these agencies were successfully cracked, 
and other secret information was obtained and disclosed. 

Offences in which information Systems act as a route roughly cover: 

1. E-mail bombing, 145 


144 These data are obtained and calculated from http://alldas.de by the author in 2001. Later the web site 
became unavailable. 

145 For an explanation of e-mail bombing and other e-mail related crimes, see Planet India Website, 
E-mail Related Crimes, n. d. Retrieved 15 Mardi 2007, from 
http://cybercrime.planetindia.net/email_crimes.htm. There, the E-mail bombing is defined as “sending 
a large amount of emails to the victim resulting in the victim's email account (in case of an individual) 
or servers (in case of a company or an email service provider) crashing.” 
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2. Harassaient through electronic communication, 146 

3. Identity theft and cyberstalking, 

4. Déniai of service attacks (cyber terrorism), 

5. Distribution of pirated software, books, magazines, audio, video or live performances, 

47 

6. Infringement of industrial secrets and State secrets, 

7. Transmission of child pornography. 148 


4.8.5 Information Systems as a place of the offence 


In the infonnation âge, much of the money, assets, State secrets and personal privacy are 
transformed into computer data and stored in computers, or circulated through the Internet. 
Meanwhile, networks become a giant gallery of pornography, or a gambling house. Networks 
do not hâve value orientation, hâve no culture, hâve no legal consciousness, but the 
information stored and the activities taking place are either protected or prohibited by law. 


146 See, for example, R. v. Jonhson (Johnson, R (on the application of) v DPP [2005] EWHC 3123 
(Admin) (8 December 2005)), the accused used both traditional mail and electronic means to harass 
the victim. He searched the home address of the victim through the Internet, and sent letters or e-mails, 
harassing the victim directly, or sent letters or e-mails to the employer of the victim questioning her 
conduct, harassing her indirectly. This behaviour not only affected the victim herself, but also her 
family and others. In R. v. Debnath ([2005] EWCA Crim 3472), the female perpetrator harassed the 
male victim by sending fake e-mails to his fiancée and employer; by registering the victim on a web 
site for people with sexually transmitted diseases seeking sexual liaisons; and by setting up a web site, 
which had fake information detailing alleged homosexual practices by the victim, and so forth. In X v. 
European Central Bank ((Officiais) [2001] EUECJ T-333/99 (18 October 2001)), the perpetrator 
repeatedly procured through the Internet documents of a pornographie and political nature and, of 
having sent them to third parties through e-mails, sent his colleague numerous messages through 
e-mails containing pornographie and ideologically extreme materials, despite the disapproval of the 
colleague concerned. 

147 In KKO:1999:115, the accused allowed e-mail users to copy computer programmes from the 
mailbox. The mailbox could be viewed as a deposit place, but the software was transferred through 
information Systems. 

I4S In United States v. Muick (Seventh Circuit No. 97-CR-30004, 8 February 1999), the American 
défendant used téléphoné and modem to download child pornography from a computer in Mexico in 
1994, when the Internet was not pervasive. In R. v. Treleaven (Provincial Court of Alberta, 2006 
ABPC 99, No. 060138286P1, 24 April 2006), the accused possessed 20 gigabytes of child 
pornography files which were identified depicted real children of both genders. While the police 
arrested him, his computer was still online, with dozens of other users queuing up to access the 
pornography. 
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Furthermore, the “place” of networks is trans-territorial outside a unified legal System. 
Aggressions and harm take place at the terminais, which seems to be the only place where the 
crimes occur. 

Factually, this is contradictory brought about by the spécial characteristic of the “place” 
of network. When the Internet is used to facilitate gambling, pornography, prostitution or 
trading in prohibited drugs, it become a cyber casino, a cyber brothel, a cyber muséum or a 
cyber storehouse. 

Dellnitcly, the Internet cannot be a real place for prostitution, but it facilitâtes the 
provision of and spread of information about prostitution to unspecified third parties. The 
Internet can also be a convenient marketplace for pirated software, books, pictures and audio 
dises and videodiscs. People also transact prohibited articles as well as prescribed medicine, 
including weapons, drugs, and philtres. Advertisements for the transaction of human organs 
also appear on the Internet (Li 2003). 

In some countries, it is prohibited to create, replicate and spread pornography, either 
adult or child, either online or offline. In addition, downloading and browsing pornographie 
web pages is illégal as well. In some other countries, however, adult pornography is legal. 
The conflict of jurisdiction may also take place in gambling and prostitution, drug traflficking, 
money laundering, and trade in weapons and even human trafficking. It is beyond the reach 
of domestic laws. More than ever before, the conflicts of criminal juridictions hâve become 
a serious concern. Thus in the face of the Internet, State control is diminished and criminals 
can launch attacks firom another country where law enforcement is absent. 

Furthermore, the Internet is likely to become the battlefield where cyber warfare takes 
place. The cyber-war criminals should be held liable for offences comparable to those 
punished by présent international criminal law. 

Offences in which information Systems appear as crime scenes roughly cover: 

1. Intellectual property infringement, 149 

2. Collection and exhibition of child pornography, 150 

149 Convention on Cybercrime, Article 10 criminalizes offences related to infringements of copyright 
and related rights. 

150 The hard drive and other deposit media can easily save thousands of images. In R. v. Paton (2005 
NUCJ 7), the accused saved approximately two thousand images of children in the hard drive of his 
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3. Sale of illégal articles (such as fire arms, alcohol, prescriptive drugs and other 
controlled substances), 151 

4. Online (illégal) gambling, 

5. Fraud on the Internet (such as Internet auction fraud, multi-level marketing fraud). 


4.8.6 Information Systems as means of the offence 


Computers and networks can also be a means in offences such as assault, threat, 
harassment, creating a false alann, spam and fraud through text, audio or video infonnation. 
Infonnation Systems are used as a means of communications in these cases. The comparable 
traditional mechanism is the postal System and téléphoné System. Dissidents hâve found ways 
of using e-mail and WWW as both media and means to air effectively their political 
grievances. As to information Systems as a means, the e-mail and WWW simply play the 
function of a post office or a téléphoné company. Information can be exported from one part 
of the globe, where it is not necessarily illégal, to a State where possession of such data is 
criminalized. The e-mail and WWW also provide dissidents with an uncontrollable means of 
communication between their domestic and overseas comrades. This has implications for the 
freedom speech of citizens and the State stability of related countries. 

Offences in which information Systems act as a means roughly cover: 

1. Electronic extortion, harassment, creating a false alarm, threatening, and assault, 152 


computer. In United States v. Long (Seventh Circuit No. 04-1721, 22 February 2005), the accused 
saved tens of thousands of images of child pornography on a computer that he kept at work (p. 1); 
while in the United Stated v. Newson (Seventh Circuit No. 03-3366, 5 April 2004), the perpetrator 
saved child pornography (pictures of his daughter and his ex-girlfriend’s daughter) in his own 
computer. In R. v. Reynolds & Ors ([2007] EWCA Crim 538 (08 March 2007)), the police found in the 
computer equipment a total of “1,757 still photographs and eight movies at level 1; 1404 stills and 46 
movies at level 2; 54 stills and 2 movies at level 3; 22 stills and one movie at level 4; and 7 stills at 
level 5.” 

151 For example, in R. v. Hamilton, 2005 SCC 47, Docket: 30021, over the Internet the accused sold a 
package of 200 files, about 5 of which “contained material relating to constructing bombs, breaking 
and entering, and ‘visa hacking’,” one of which “contained information on a credit-card number 
generator” (paragraph 2). 

152 In United States v. Ray (Eighth Circuit, No. 05-1655, 15 November 2005), the perpetrator sent 
e-mails to a company to extort 2.5 million US dollars by threatening to exploiting a breach in its 
computer security (p. 1). In R. v. Lefave (Ontario Suprême Court of Justice Court File No. 
CrimJ(P)6527/02, 3 October 2003), during an Internet chat between a woman and a man, the man who 
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2. E-mail spoofing (phishing). 


153 


4.8.7 Information Systems used in préparation for other offences 


Infonnation Systems are increasingly being used to préparé for further offences. These 
offences include both cybercrimes and traditional offences. More and more traditional 
offences against person or property seek assistance from infonnation Systems. Wasik (1991) 
stated that “it is certainly conceivable that a computer may be used as the means of bringing 
about a person’s death or causing physical injury,” with associated offences including 
destruction and damage, déniai of access to authorized users, death, physical injury, and 
endangerment, blackmail, corruption, official secrets, etc. (p. 150) Perpetrators frequently 
exploit infonnation Systems in two ways. One is that perpetrators conspire through the 
Internet (for example Guo and Wang, Great River Newspaper, 29 July 2003). Other cases 
hâve also involved conspiracy to commit robbery, abduction, and so forth. The second 
manner of exploitation is that the perpetrators pursue victims through the Internet. The most 
cominon cases involve robbery, abduction, murder, blackmail, and râpe (for example, Geng, 
Pingliang Daily, 27 February 2003). 

Cybercrime is a topic covering a very wide scope. Almost ail the traditional crimes, 
including murder and arson, can be committed with the assistance of computers and networks. 
To call these crimes cybercrime is not inappropriate, and considération of the use of 


later became the accused stated that he "wanted to râpe his seven year old daughter and kill himself." 
The woman disclosed the concerns to the police. He was charged with communicating a threat using a 
computer. 

153 Phishing “consists of creating fictitious domain names and websites ail with a view to extracting 
bank account details from gullible individuals.” See Novus Crédit Services Inc v Discover Financial 
Services LL C [2006] DRS 03205 (27 January 2006). Through phishing site, the perpetrator can obtain 
“key personal details from users of the webpages to which those domain names resolved” 
“fraudulently” (See Alliance & Leicester PLC v Brawn [2006] DRS 4135 (18 December 2006)) or the 
perpetrator may acquire “confidential fmancial information inappropriately” (See Royal Bank of 
Scotland Group PLC v Laverio [2006] DRS 3953 (16 October 2006)). In United States v. Désir 
(Western District of Pennsylvania, 2005), the accused devised a scheme to defraud through fraudulent 
web sites, persons who believed they were dealing with web sites of legitimate institutions, and online 
auction and payment services. E-mail spoofing can also be used in e-mail bombing. For example, in 
United States v. Carlson (Third Circuit No. 05-3562, 12 December 2006), the accused launched two 
types of e-mail attacks: direct attack, in which he directly sent thousands of e-mails from different 
addresses to one address to flood it; and indirect attack, in which he sent one e-mail from one address 
to thousands of different addresses, but the sending address was the one that he spoofed. 
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computers and networks into research of these crimes is also necessary. 

However, this dissertation studies cybercrimes with unique characteristics, specifically, 
the crimes relating to security, including the security of infonnation Systems, the security of 
e-commerce, and the security in which information Systems serve a critical infrastructure. 
Although murder and arson are also tied up the issue of security, for example, the security of 
life and health, public security, property security and so forth, they are neither unique to the 
information society nor do they hâve spécial features. The crimes discussed in this 
dissertation are limited to those in which information Systems play a unique rôle, as either 
target, tool, route, place, medium, means, or they are used in préparation for other crimes. 
Other crimes may be referred to when necessary in discussing these crimes. 

Offences in which information Systems are used in préparation for other crimes cover a 
broad range, but the most usual ones roughly cover: 

1. Communications in furtherance of criminal activity or criminal conspiracy, 154 

2. Electronic money laundering, 

3. Online tax évasion, 


In R. v. Poon and Wong, 2006 BCSC 1824, Docket: 23635, four offenders abducted a victim from 
whose family they requested a ransom, during which they sent proof-of-life photographs through the 
emails to the victim’s family or friends (paragraph 15). In R. v. Kwok, 2007 CanLII 2942 (ON S.C.), 
Docket: P134/06, from the computer of the accused were revealed of about 2000 images and 60 video 
clips of child pornography. Along with these materials was recovered written material of “graphie 
chatroom conversations between paedophiles about how much they enjoy sexually abusing young 
children and babies and about where pictures and videos of such activity can be obtained.” (paragraph 
1). In R. v. O’Brien (2002 YKTC 94, Docket: 02-00176A • 02-00305), the accused used pagers, cell 
phones and computer internet email to communicate with cocaine suppliers and other 
associates(paragraph 4). In R. v. Brown, 2006 CanLII 12302 (ON S.C.), Docket: C44863, the accused 
used e-mail and other online communications to contact a girl on the âge of 13, with the intent making 
her leave her family. In United States v. Christopher Lee Adjani; Jana Reinhold (No. 05-50092 D. C. 
No. CR-04-00199-TJH-01 OPINION, 13 January 2006), the accused were charged with conspiring to 
commit extortion and transmitting threatening communications with intent to extort, based partly on 
the incriminating e-mails seized in their computers (p. 7581). In R. v. Taylor and Burin ([1997] EWCA 
Crim 1074 (2 May 1997)), Burin made checks on the Police National Computer to obtain the address 
of the owner of a car (usually one he had recently sold to the new owner) and passed the information 
to Taylor to use it to steal the car. Burin also modified information so that stolen vehicles would appear 
to be recovered, enabling Taylor to possess stolen cars. In the U. K., Section 58(1) and (2) of the 
Terrorism Act 2000 provides that possession of a computer file of a particular nature is likely to be 
punished, even if it is freely downloaded from the Internet: 

“(1) A person commits an offence if- 

la) he collects or makes a record of information of a kind likely to be useful to a person 
committing or preparing an act of terrorism, or 

(b) he possesses a document or record containing information of that kind. 

(2) In this section "record" includes a photographie or electronic record.” Some cases hâve been 
punished according to this act, for example, R. v. Boutrab ([2005] NICC 36 (24 November 2005)). 
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4. E-mail spoofing (phishing). 

5. Child exploitation. 155 


4.8.8 Conclusion 

It is worth noting when I classify the potential rôles of infonnation Systems in 
cybercrime or other crimes, I do not consider them as separate ones. As it has already been 
noted that, these rôles can possibly be separated, found to be overlapping, or integrated in one 
and the same case. For instance, in McKinnon v USA & Anor, 156 the accused used his own 
computer to access illegally 97 computers of the U. S. govemment, installing remote control 
software, acquiring IDs and passwords, and deleting data from these computers. He even left 
a message expressing his interest in hacking these computers. Here, his own computer is a 
tool, the Internet is a route, and the U. S. governmental computers and the data in them are 
targets, and so forth. In R. v. DO, 157 the accused took the minor female victims to the 
computer and behaved indecently while chatting online with women, during which he also 
touched the victims inappropriately on the breasts and vagina, showing them online 
pornography. The rôles of information Systems in such cases are multiple. 

In drafting législation, it is also hard to give a clear-cut division between the different 
rôles of infonnation Systems or of the part of it relevant in detailed offences. If any efforts are 
to be made for determining such a borderline, for example, one of the most puzzling 
situations will be met with in an offence relating to cybercriminal devices, particularly 
unauthorized possession, transaction, transmission, and utilization of passwords. 159 The 
passwords can be regarded both as a target, being a part of infonnation Systems, and a tool, 
for illégal access to the other part of information Systems, in the same offence. 


For example, in United States v. Meek (No. 03-10042, 12 January 2004), the accused used the 
instant messenger to lure a child into a sexual encounter. 

156 [2007] EWHC 762 (Admin) (03 April 2007). 

157 [2006] NICA 7(10 March 2006). 

15s ibid., paragraph 9. 

159 Such conducts are criminalized in the Convention on Cybercrime as Misuse of Devices (Article 6). 
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4.9 Clarification of relevant conceptions 


After reviewing previous définitions and providing a role-oriented définition, the current 
section will tum to clarifÿ sonie relevant conceptions that are usually used to describe the 
characteristics of cybercrime. The définition of cybercrime has long been a pending question 
with regard to the existing criminological théories. The alternatives hâve been abundant and 
there hâve been a controversial exploiting of different théories by different researchers with 
different standpoints or with different empirical proofs. The concepts involved in this field 
include white-collar crime and économie crime, etc. The following paragraphs are designed 
to clarifÿ the relationship between cybercrime and some of these concepts separately. 

4.9.1 White-collar crime 

Unlike most other criminal phenomena that bear traditional names, the conception of 
white-collar crime was coined by Edwin H. Sutherland in 1939 160 and defined 
“approximately as a crime committed by a person of respectability and high social status in 
the course of his occupation” (Sutherland 1949, p. 9). The historical development of and 
theoretical disputes over the patterns of white-collar crime hâve created many different 
définitions (Friedrichs 1996, pp. 2-11). Yet many are still making efforts to express their new 
understanding about the phenomenon (ibid., pp. 6-7; Helmkamp, Bail, and Townsend, 1996). 
The théories involved differ in emphasizing certain characteristics of white-collar crime such 
as “commission in a legitimate occupational context, respectable social status of perpetrators, 
presence of calculation and rationality (with économie gain or occupational success a primary 
goal), absence of direct violence, offenders’ non criminal self-image, deterrence of and, a 
limited criminal justice System response.” (Friedrichs 1996, p. 6, citing different sources) 
Debates among criminologists also extend to the terminology, définition, and other issues 

160 Geis and Goff stated in an introduction to the 1983 version of Sutherland’s book “White-Collar 
Crime” that “The thirty-fourth annual meeting of the American Sociological Society -convened in 
Philadelphia in 1939 during the academie recess between Christmas and New Year- was held jointly 
with the fifty-second gathering of the American Economie Association... Sutherland’s talk was entitled 
‘the While Collar Criminal,’ and it altered the study of crime throughout the world in fundamental 
ways by focusing attention upon a form of lawbreaking that had previously been ignored by 
criminological scholars.” (p. ix) Therefore, Sutherland initially coined the term “white-collar crime” in 
1939, published the paper in 1940, and published the book in 1949. 
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(ibid., pp. 6-7). 

The proposai for a concept “white-collar crime” was prior to the invention of the 
computer and the establishment of computer networks in the présent sense, and most 
certainly before the emergence of computer criminal phenomena. The involvement of 
information Systems in white-collar criminal activities leads people to attribute computer 
crime to white-collar crime because the process of the former has usually been considered 
impossible without a high level of knowledge or without convenient opportunities for access 
to the machine. The general public used to view computer crime as complicated because they 
had little chance for revealing the truth of the digitalized processing. In addition, the reality 
of computer crime has possibly been distorted due to overemphasizing business victims and 
underemphasizing consumer victims (Kling 1980, p. 14). 

Some studies hâve found that cybercrime is a low-technological crime, and not a 
high-tech crime (Molnar 1987). With the popular use of computers and networks, more than 
17 percent of the world population are connected online (Internetworldstats.com 2007), and 
the growth rate is still high. The tools available to only a small group of computer users in the 
past are now available to a large population who hâve their own computers and who are 
connected to global networks. More and more potential cybercriminals do not need 
sophisticated skills for creating malicious codes by themselves. Compared with traditional 
violent crimes, a majority of current cybercriminals are not manufacturing guns and powder, 
but picking them up and shooting. Even the rest of the cybercriminals can use available 
programmes to produce malicious programmes to reach their goals. Therefore, “respectability 
and high social status” are irrelevant among today’s cybercriminals. 

Définitions of almost ali dérivatives hâve insisted that the offences involved are 
committed in the course of employment. In cybercrime, such offenders would express 
themselves in the fonn of launching inside attacks. But otherwise, I hâve found that insiders 
only make up one fifth of the cybercriminals successfully prosecuted (Li 2006). That is to say, 
most of these cybercriminals do not commit cybercrime in their employment. This provides 
further négative proofs against the claim that cybercrime is wholly coincident with the 
concept of white-collar crime. 

Criminal phenomena, particularly those in new fields, are continuing to be transformed 
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from simple to complex, from more traditional to more modem, from non-occupational to 
more occupational. White-collar criminals’ increasing exploitation of infonnation Systems is 
a predictable tendency. 


4.9.2 Economie crime 

There has never been a widely accepted définition of économie crime. An example of one 
définition can be taken from Sjôgren and Skogh (2004, p. 1), who hâve defined économie 
crime as a crime committed to gain profit within an otherwise legal business. 
Recommendation No. R (81) 12 of the Council of Europe’s Committee of Ministers of 1981 
listed a broad range of offences into économie crime, including computer crime, particularly 
theft of data, violation of secrets, and manipulation of computerized data. The relevant 
literature has taken it as natural that computer crime is a crime in which the computer is used 
as an instrument of économie crime (for example, Johnson 2006, p. 1). Actually, the motives 
of cybercrime can be very wide and cover dozens of different kinds of crime. Profit gaining is 
only one of the numerous motives of cybercrimes. 

Although it is difficult to find a motive behind a cybercrime (Philip 2002, p. 7), many 
different studies and research hâve drawn diversified conclusions on the classification of 
motives. According to Jordan and Taylor (1998), there are six cornmon attitudes among 
hackers: addiction, curiosity, thrill of information searches, ability to access, peer récognition, 
and identifying security loopholes. Maiwald (2003, pp. 36-38) has concluded that hacker 
motivations fall into three categories, including the quest for challenge, greed, and malicious 
intent or vandalism. Kiger and co-workers (2004) hâve summarized the motivations of 
cybercrime as money, entertainment, ego, cause, entrance to social groups, and status. Pipkin 
(2002, pp. 17-28) has proposed that hackers may hack from a sense of intellectual motivation, 
such as educational expérimentation, harmless fun, as a wake-up call; personally motivated, 
such as disgruntled employées, cyber-stalking; socially motivated, such as cyber-activism; 
politically motivated, such as cyber terrorism, cyber-warfare; financially motivated; and 
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motivated by ego. Kremen (1998) has classified hackers into ten types with “different sizes, 
flavours and colours.” 

In fact, the motives of cybercrime may vary in a way that is beyond the imagination. If 
we say that many cybercriminals hâve similar motives, we can also say that nearly every 
perpetrator has his or her own. Bequai (1983, pp 44-45) has summarized 17 different kinds of 
motives that propel the potential perpetrators to take the risk of committing computer crime. 
In Chapter 6, I identify and discuss more than twenty kinds of the commonest motivations 
according to the literature, cases and empirical studies. 

The reasonable conclusion drawn froni the above studies is that the conceptions of 
cybercrime and économie crime are correlated but not identical. Some cybercrimes can be 
classified into économie crime, while some others cannot. It is also clear that économie crime 
committed with the computer and on computer networks make up only a part of the whole 
phenomenon of économie crime. 


4.9.3 Corporate crime 

Yeager and Clinard (2006) hâve defined corporate crime as “any act committed by 
corporations, that is punished by the State, regardless of whether it is punished under 
administrative, civil, or criminal law” (p. 16) and they hâve regarded it as a particular type of 
white-collar crime (p. 17). It is possible for corporations to commit cybercrime, and the 
relationships between these conceptions are become ever more puzzling. 

What is still unclear is the extent to which computer crimes are committed by 
corporations. In my study (Li 2006), corporate perpetrator was involved in only one out of 
115 cases, while ail other cases were committed by either a single individual or group of 
individuals, at most the organized groups. Although the finding of the study cannot be 
regarded as having universality, it has sense in that not ail cybercrime are being committed 
by corporations or organizations (Ibid). 
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4.9.4 Professional crime 


Insiders and outsiders constitute different ratios in different categories of offences. The 
categories in which the insiders constitute the majority of offenders include: data theft, 
espionage, and firaud (Li 2006). 

The categories in which outsiders constitute a majority of offenders include: ail identity 
theft, 92.9 percent of embezzlement and corruption cases, 87 percent of attack and sabotage 
cases, 81.8 percent of viruses, worms, spyware and logic bombs, and 76.2 percent of hacking 
and sabotage cases. In fact, outsiders also constitute a strong ratio among fraudsters: about 
42.9 percent (Ibid). 

Former employées are included in the category of outsiders. A significant ratio of 
offenders who attack and sabotage are former employées, who constitute about 43.5 percent. 
Former employées also constitute 12.7 percent of offenders in hacking and illégal access 
cases, and about 7.2 percent of offenders in embezzlement and corruption cases (ibid). 

Overall, insiders and outsiders constitute 21 percent and 79 percent of ail reported 
offenders separately classified. Fonner employées constitute 16 percent of ail the outsiders. If 
we add up former employées into insiders, they would constitute about 34 percent of the total 
number of offenders, still a smaller ratio than the outsiders. The safe conclusion is that 
cybercrime is again not a professional or occupational crime (ibid). 


4.9.5 Trans-national crime 

Globalization is the hallmark of modem économie and legal activities. The trans-border 
movement of personnel, goods, and information paints an embarrassing picture of national 
boundaries. Information Systems alone are no longer subject to the physical limit of 
traditional countries. Many offences traditionally committed in neighbourhoods, 
communities, and native areas now extend beyond national boundaries. Many other offences 
traditionally committed in a trans-border manner are becoming a means to acquire new 
markets in the more networked globe. Some new offences can, indeed, only be completed in 


151 



a trans-national style. Trans-national crime can be seen as the counterpart of international 
trade in civil society, being an involuntary transaction between perpetrators and the social 
order (in many cases, involving victims, but in many other cases, victimless). 

For example, in McKinnon v USA & Anor, 161 the accused used his own computer in 
London and obtained unauthorized access to dozens of governmental computers of the U. S., 
firom which he discovered the identities of certain administrative accounts and associated 
passwords. He installed remote control software on these administrative computers. The 
software enabled him to access and change data at any time. 

Many people hâve taken it for granted that because computer networks are 
trans-national, naturally most crimes committed in relation to the networks are also 
trans-national. This poses a great concem among academia, law-enforcement agency, and 
législature. However, this is still an unanswered question. In my study (Li 2006), altogether 
14 out of 115 cases were committed by international perpetrators or foreigners, a ratio 
weaker than 12.2 percent. Domestic perpetrators were responsible for the remaining 87.8 
percent of cyber criminals. The majority of the reported cases are domestic computer 
offences (Ibid). 

We can explain this phenomenon by listing the possibilities: 

First, information Systems hâve crossed the national boundaries, but prosecuted offences 
are mostly confined within these boundaries; 

Second, due to lack of an international arrangement of law and enforcement, few 
trans-national cybercrime offenders hâve been investigated; and 

Third, offences are mostly territory-dependent, and do not cross the border at ail. 

Ail these factors are responsible for the low likelihood of trans-national cybercrime, but, 
as we hâve seen and will see further, the absence of international legal harmonization and 
assistance mechanisms contributes primarily to the current invisibility of trans-national 
cybercrime. 


4,10 Conclusion 


[2007] EWHC 762 (Admin) (03 April 2007). 
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The phenomenon of cybercrime is comprised of complicated acts and facts, which are 
multifarious, concealed and changing. There is no ready-made theory applicable for defining 
and categorizing various practical cases. A great many disputes exist among experts as to 
what exactly constitutes a cybercrime, for there is a lack of an internationally recognized 
criterion. Due to the lack of unified définition and classification schedule, the co-existence of 
different viewpoints inevitably results in conflicts in international law enforcement and to a 
waste of judicial resources. Cybercrime includes both new crime utilizing computer Systems 
and new fonns of existing crimes exploiting computer Systems. 

Theoretical and legislative classifications group cybercrimes into different categories. 
However, the most characteristic pattern of cybercrime is that the detailed offences are more 
or less linked to information Systems. The rôles of information Systems in the offences 
perpetrated hâve the potential to develop. The starting-point of cybercrime research should 
focus on the récognition of the rôles of information Systems in the offences perpetrated. It is 
the information System that makes perpetrators breach security protection, to exploit the 
function of this System, to transmit illégal materials through this System, to operate illégal 
commercial activities in this System, to air offensive speech in the forum of this System, to 
communicate with this System, and to use this System to préparé murder, harassment and 
other traditional offences. 

The définition does not détermine the existence of cybercrime. Nevertheless, the 
définition endows this phenomenon a place on the academie terrain. Through définition, we 
are changing “cybercrime” into a research topic. Potential cyber warriors and cybercriminals 
may also leam from cybercrime incidences, about how they are committed, why they are 
reported, and what legal results are induced, etc., so that they can better trick the 
cybersecurity management, the victims and law-enforcement agencies. In contrast to the 
incentives of the crime perpetrators, scholars should analyse how and why these criminals are 
motivated, how and why victims are exposed, and how and why guardianships are absent. 
The next chapter will discuss the topic at the level of cybercrime as an academie research 
topic, to justify the value of cybercrime research. 
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CHAPTER 5. CYBERCRIME AS A RESEARCH THEME 


5.1 Introduction 

As we hâve seen in the previous chapters, due to the potential hann, both new types of 
crimes and new forms of old crimes concern individual and organizational social actors. 
Cybercrime has become one of the focuses of scientific research: as a research theme, a 
university course, a thesis topic, and particularly a multidisciplinary research topic. Research 
activities heavily rely on infonnation Systems, meaning research into the relevant literature, 
and court decisions with the making of international comparisons, too. This chapter gives a 
concise sketch of cybercrime as a research theme, and the spécial research methods facilitated 
by infonnation Systems. 


5.2 A new research theme 

We must currently take up a new fleld of study, a field different firom any we hâve 
previously entered. The knowledge concerning cybercrime has become a challenging topic of 
scientific literature. This literature deals with questions such as: 

1. Description, including discussion of terms, définitions, characteristics, motives, scope, 
and scale of cybercrime; 

2. Scientific analysis, including analysis from the standpoints of criminology, criminal 
law, sociology, psychology, politics, ethics, culture (and subculture), économies, and 
technology, etc.; and 

3. Countermeasures, including recommendations from the viewpoints of technology, law, 
ethics, sociology, and économies, etc. 

As far as legal countermeasures are concerned, the literature covers both substantive law 
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and procédural law. Concerning substantive law, the literature endeavours to résolve the 
problems of the corpus delicti of cybercrime, gives a review of and a proposai on the 
adaptation of traditional law and the adoption of new law, a proposai on international 
hannonization, etc. Concerning procédural law, the literature seeks to résolve the problems of 
search and appropriation of evidence, the tracing and recovering of electronic evidence, 
problems arising from interception and privacy protection, and the use of international 
assistance, etc. 

Academie literature on cybercrime has been published in both the traditional and digital 
media. Law-enforcement agencies hâve also published relevant reports and proposais. 
International organizations are playing a significant rôle in implementing directives, 
guidelines, recommendations, and treaties. These establish a bedrock for implementing legal 
instruments and promoting international coopération. 

In addition, cybercrime has become one of the thèmes of academie conférences, which 
are held at différence ranges, scales and for different purposes. 162 These forums provide 
opportunities for people from different professional fields to exchange knowledge on 
phenomenological, legislative and judicial issues. Based on these exchanges, consensus is 
gradually expected to be reached. 

Some of these conférences are comprehensive, covering a wide range of topics. However, 
some conférences hâve concentrated on one or several spécifie topics with the purpose of 
increasing awareness at the public level, the State level, or international level; or having the 
purpose of discussing legislative or judicial issues. In addition, the coinmon focus of these 
conférences is to discover an increasingly successful approach to deterrence. 

Again, cybercrime has been developed as a university course. Many universities teach a 
course specifically entitled “Cybercrime”. Others incorporate contents of cybercrime as part 
of their courses in criminal law, criminal justice, criminology, legal infonnatics, legal 
psychology, or law and technology, for examples, Lehtonen (2006), Saarenpaa (2005), etc. 

162 For example, the Council of Europe Cybercrime Conference-High-Level Conférence on the 
Challenge of Cybercrime, Strasbourg 15-17 September 2004; the Department of Defense Cyber Crime 
Conférence 10-13 January 2006; Cybercrime Summit (2003-), Kennesaw State University, 19-23 
March 2007; the CyberCrime and Digital Law-enforcement Conférence, Yale Law School, 26-28 
March 2004. 
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The contents of the course may hâve a different coverage. Generally, these courses 
analyse how the new infonnation technologies are influencing the traditional legal approach 
to crime. For example, the course at the George Mason University explores the history of 
cybercrime, examining security-related, content-related, data-related, and system-related 
crimes, as well as individual, corporate and organized cybercrime and cyber terrorism. 
Inevitably, the course also deals with both substantive and procédural law problems, with 
spécial regard to both social-order maintenance and human-rights protection. 163 The course 
instructor in the University of Essex recognizes the trans-national nature of cybercrime, takes 
a comparative approaches with spécial regard to North American législation and the European 
Convention on Cybercrime. 164 

As far as the objectives and projected learning outcomes are concerned, the course 
instructor at the University of Leeds has expected that the participants will understand the 
criminal opportunities brought about by the ICT and will explore the theoretical and 
legislative issues related to cybercrime. 165 Because courses may be provided in different 
institutions for students of different concems, they are also designed to meet different needs. 
The emphases in the courses thus range from theoretical exploration to practical training, 
from legislative reasoning to law-enforcement design, and from public régulations to private 
countenneasures. 

A typical structure of the course at the University of Oregon, for example, is composed 
of an introduction to “cybercrime”; substantive criminal-law issues; investigative techniques 
and tools; procédural criminal-law issues; international hannonization, and conclusions. 166 In 
other institutions, the course may deal with a narrower scope of issues, but the general 
knowledge of cybercrime is a necessary component. 


163 For example, the course on Cybercrime, that is, Cybercrime -Law 499, at the George Mason 
University School of Law. See the Homepage of George Mason University School of Law. Retrieved 
15 March 2007, from http://www.gmu. edu/departments/law/academics/course_detail.php?num=499 

164 For example, the course on Cybercrime, that is, Cybercrime - LW 655, at the University of Essex. 
See the Homepage of Department of Law, University of Essex. Retrieved 15 March 2007, from 
http://courses.essex.ac.uk/lw/ 

165 As described in the course at University of Leeds, Department of Law, Computers and Crime in 
the Information Age (LAW2410). See Homepage of Department of Law, University of Leeds. 
Retrieved 15 March 2007, from http://www.leeds.ac.uk/law/lawmods/cybercri.htm 

166 University of Oregon School of Law, Cyber Crime Course, Spring Semester 2004. Retrieved 15 
March 2007, from http://www.scanit.be/downloads/Feb2002_Arabian_Computer_News.pdf. 
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Lectures on cybercrime are being given in both traditional and innovative ways. 
Cybercrime is closely connected with ICT, which is designed to improve the “efficiency, 
accessibility and quality of the learning process” (Lesgold 1993, pp. 377-382). Computers and 
networks provide abundant infonnation resources, leaming resources and guidance resources 
(Ibid). Cybersecurity training and cybercrime courses are increasingly delivered through 
information Systems, which facilitate as big an audience as possible. 

Furthermore, cybercrime has become a popular thesis topic. Students hâve increasing 
interests in the topic of cybercrime. For the sake of acclimatizing students to the social 
requirement, more and more law schools are making efforts to train experts in the field of 
cybercrime research. From various sources, we can recognize that many students succeed in 
completing their degree study after submitting theses on cybercrime, for example, Kowalski 
(1994) and Silvander (2004) in Sweden, Pihlajamaki (2004) in Finland, Abdulla (2006) in the 
U. S., to name some. 

Finally, cybercrime has become a favourite topic in multidisciplinary research. The 
courses on cybercrime offered in many universities are actually based on multidisciplinary 
research. Institutes for legal informatics hâve been established in many universities Courses 
on legal infonnatics are offered broadly, which integrate the content of computer security and 
protection, and cybercrime. 167 


167 For example, Centre de Recherches Informatique et Droit, Facultés Universitaires Notre-Dame de 
la Paix de Namur; Interdisciplinary Centre for Law and Information Technology (ICRI), Katholieke 
Universiteit Leuven in Belgium. Institute for Legal Informatics, Faculty of Law, University of Lapland, 
Finland. Norwegian Research Centre for Computers and Law (NRCCL),University of Oslo, Norway. 
Institut für Rechtsinformatik, University of Hanover; Intitut für Informationsrecht, University of 
Karlsruhe; Institute for Law and Informatics, University of Saarland in Germany. Institute for Legal 
Philosophy, Sociology of Law and Legal Informatics, Faculty of Law, University of Graz; 
Universitàtslehrgang für Rechtsinformatik und Rechtsinformation, University of Vienna in Austria. 
The Laboratory of Legal Informatics of the Institute of State and Law of the Academy of Sciences of 
the Czech Republic. In Spain, Informâtica y Derecho, Universidad de Zaragoza; Centre of Law and 
Computer Studies of the Balearic Islands, University of the Balearic Islands. Institutet for 
ràttsinformatik, University of Stockholm, Sweden. Information Technology Law Unit, Centre for 
Commercial Law Studies (CCLS), Queen Mary & Westfield College, University of London; Centre 
for Law, Computers & Technology, University of Strathclyde in U. K.. Research Centre of History of 
Law, Philosophy and Sociology of Law and Computer Science and Law, Università degli Studi di 
Bologna, Italy. Department of Legal Informatics, University of Lithuania; Legal Informatics Centre, 
Vilnus University in Lithuania. Computer Law Institute, Faculty of Law, Vrije University, Amsterdam; 
Department for Law & IT, University of Maastricht; Centre for eLaw (Centrum voor recht in de 
informatiemaatschappij), University of Leiden; Institute for Information Law, Faculty of Law, 
University of Amsterdam; Centre for Law & ICT, University of Groningen; Law & Technology 
Department, University of Rotterdam; Centrum voor Recht, Bestuur en Informatisering, University of 
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Computer security specialists, sociologists, criminologists, psychologists, psychiatrists, 
economists, and jurists are ail engaged in studies and research on cybercrime. On the 
understanding that studies and research emphasize particularly theoretical discourses, the 
globally-established anti-cybercrime institutions not only provide theoretical explanation, but 
also provide practical findings. They supply laws and cases, proposais and guidelines, etc. 


5.3 Information Systems and cybercrime research 

The research process relies heavily on information Systems, through research into the 
relevant literature and court decisions, thus rendering international comparisons more 
attainable; while additionally, the results of experiments are also available from spécifie 
laboratories. 

First, research on the existing literature represents an important approach for scholars to 
develop their own ideas. The research on cybercrime has been pursued for several décades 
and the previous literature provides a shortcut for latecomers. 

From the historical standpoint, it is worth noting that when the Internet began, it was 
strongly connected with military and academie activities. Now, with many resources uploaded 
on the networks, cyberspace facilitâtes legal research work. 168 The unprecedented 
accumulation of knowledge in the new media helps the construction of the global village 
(Güvenen 1998, pp. 1-10). Worldwide scientific research networks also give power to 
cybercrime research. Web-assisted legal study has become a realistic and feasible approach. 
The development of both the private sector and public sector in digitalization and 
informationization as well as the establishment and open access of legal databanks has 
considerably eased the research (Ibusuki 1995, 1996). There are also a great many systematic 


Tilburg in the Netherlands. Centre for Legal and Economie Issues of Electronic Communication, 
University of Wroclaw, Poland. In the U.S., Legal Information Institute, Comell Law School. In 
Australia, Australasian Legal Information Institute, joint facility of UTS and UNSW Faculties of Law. 
This is only a sélective list established through search engines by the author. 

168 Lyonette Louis-Jacques, Legal Research Using the Internet. Retrieved 15 March 2007, from 
http ://www.lectlaw. com/files/lws5 6.htm 
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bibliographies available on the Internet, either on spécial topics or on general problems. 169 
Online academie communities can conveniently use search engines, electronic journals, 
catalogues, lists, directories, tutorials, forums, and text, audio and video interactive messages 
in their research. As far as electronic journals are concemed, they are becoming important 
resources of academie materials. The online journals take three forms: an 
electronically-augmented form of printed journals, parallel but alternative form, and 
electronic-only form. There hâve roughly two access methods: open access or access via 
subscription. At présent, low cost and broad access are enabling an increasing number of 
online journals to take the electronic-only form. 

Secondly, it is necessary to analyse cases in research on crime or on law. The status of 
court decisions has long been acknowledged in the domain of legal informatics. Cases are the 
specimens for comparative study. Mass-media news and court-case reports are the main 
sources for case study. Smith, Grabosky, and Urbas (2004) examined 240 cases (p. 10) and 
provided “the flrst international study of the manner in which cyber criminals are dealt with 
by the judicial process” (p. 13). Otherwise, Makkonen, Manninen, Montonen, and Savela 
(2003) carried out a content analysis of news on cybercrime. In countries where cases are not 
offîcially compiled, news reports become the main source for case study. 

Thirdly, one of the approaches is comparative research, which occupies a significant 
position. In the past, it was necessary to visit libraries and consult legal collections. Currently, 
it has become routine for countries to publicize laws and cases. Access to legal databases is as 


169 For example, Paul Clark, Cybercrime Treaty Bibliography, April 30, 2004. Retrieved 15 March 
2007, from http://www.wildernesscoast.org/bib/treaty-by-date.html; J.A.N. Lee, Computer Crime 
Bibliography, 24 November 2001. Retrieved 15 March 2007, from 
http://courses.cs.vt.edu/~cs3604/lib/Crime/bibliography.html. In a wider basis, James Herbsleb, A 
Bibliography of Current Issues in Cyberlaw, 6 April, 2004. Retrieved 15 March 2007, from 
http://www-2.cs.cmu.edu/~jdh/courses/Cyberlaw%200NLINE/bibliography.htm; Curtis E. A. 
Kamow^Peter Soares, Joël Muchmore, Sonnenschein Nath and Rosenthal LLP, 

Law and Cyberspace Bibliography. Retrieved 15 March 2007, from 
http://mitpress2.mit.edu/e-journals/Leonardo/isast/spec.projects/intellpropbiblio.html. In a narrower 
sense, the Public Affairs Section, the U. S. Embassy in Thailand, a Bibliography of Internet Crimes 
and Fraud, 26 April 2001. Retrieved 15 March 2007, from 
http://www.usa.or.th/services/irc/bib_inet_crime.htm. Dorothy Denning’s links. Retrieved 15 March 
2007, from http://www.cs.georgetown.edu/~denning/links.html. Vlasti Broucek, 24 March 2004. 
Retrieved 15 March 2007, from http://brouk.psychol.utas.edu.au/bibliography_old.html. Maximillian 
Dornseif, Kay Schumann, Bibliographie Computerkriminalitàt, 25 March 2002. Retrieved 15 March 
2007, from http://md.hudora.de/jura/bib-compkrim/compkrim.html 

170 Collis (1996), pp. 168-169. 
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good to Consulting the parliamentary archives. The obstacle of languages is becoming less 
serious because of online and offline translation tools, however weak these translations 
sometimes are. The availability of multilingual information is making it more effective to 
build up international comparisons. 

Fourthly, it is difficult to answer the question of “how cybercrime is committed?” before 
we can demonstrate it by a personal experiment. Real cybercrime scene cannot be learned 
merely by reading literature. If the perpetrators hâve a better understanding then their victims 
of the ways to commit cybercrimes, then, scholars, législatures, police, prosecutors, and 
judges, crime and anti-crime will be placed on an unbalanced scale. Hence, the studies and 
research on texts should be supplemented by some kinds of experiments. Observations and 
experiments are as necessary to illuminate the literature and to illustrate important 
mechanisms in cybercrime as they are in information science and information security. 

The problem lies not in whether law students are able to carry out such experiments, but 
in whether computer security laboratories are willing to accept law students. Historically, 
hacker culture was built on the supposition that access to another’s computer Systems was 
hannless. In completely controllable laboratories, law students should also be able to 
expérience the hacking process. Experiments allow people to grasp better the nature, damages 
and motives of some cybercrimes, and to grasp better their transnational influence. 

As many domestic législations, the Convention on Cybercrime does not require 
criminalizing legitimate and authorized computer security, research, or éducation practices. 171 
Some domestic législation that criminalizes conducts related to hacking tools also excludes 
punishment against network security personnel. 172 

Cybercrime laboratories are being established ail over the world, for example, Régional 
Computer Forensic Laboratories in San Diego, California. 173 Its mission is to develop a 
national government, industry, and academie collaboration to address cybercrime technical 


171 Article 6 of Convention on Cybercrime. 

172 See the U.S. Department of Justice, Frequently Asked Questions and Answers-Council of Europe 
Convention on Cybercrime, Updated 10 November 2003. Retrieved 15 March 2007, from 
http://www.cybercrime.gov/COEFAQs.htm. 

17j E.g., Régional Computer Forensic Laboratories (RCFLs) in San Diego, California, established in 
1999. This is a régional crime lab, specializing in retrieving computerized data and preserving the 
evidence for trial. See Bigelow (1999). 
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issues; share a forensic tool knowledge base; distribute cybercrime technology and tools to 
law-enforcement agencies at a national level through capacity-building packages, 
cybercrime-awareness seminars, and cybercrime-tool évaluations; heighten national 
awareness of cybercrime; provide technology assistance; and facilitate cybercrime training. 174 

The Department of Defense in the U. S. has also established a Computer Forensics 
Laboratory (DCFL) in 2001, with the mission of providing digital-evidence processing and 
analysis for the Department of Defense of setting guidelines for digital forensics analysis, of 
fostering forensic media analysis projects, and of conducting liaison by partnering with 
govemmental and private industry computer-security officiais to keep abreast of the 
cutting-edge technology. 175 

Similar to controlled experiments is the situation where individual or institutional 
researchers obtain and deposit materials that are forbidden by law. In the case of institutional 
researchers, it may be easier to demonstrate a genuine purpose for research. Puzzling is 
nonetheless the case of individual researchers. In R. v. Wrigley, 176 the court dismissed the 
appeal of the accused on grounds of genuine research, for which the accused communicated 
with paedophiles and downloaded pictures of child pornography from the Internet. The 32 
disks seized by the police containing 677 indécent images of children became evidence for his 
conviction, even though he claimed that he was collecting materials for his possible PhD 
thesis. The court held that the timing of the offence occurred the idea of any such a research. 
Nor was the pursuit of a hobby any excuse. In CN v Secretary of State, 177 the perpetrator 
viewed nude or partially nude pictures on his computer, but he insisted that he was a 
photographer with a spécifie interest in nudes and naturism. For this purpose, he regarded the 
websites that he obtained access using his crédit cards as part of his whole interest, a 
legitimate part, and occurring “in dedication to a particular photographer's work.” He stated 
that he looked at images that “...were tasteful, artistic images or naturist images. On the few 


174 See JUSTNET, CyberScience Laboratory. Retrieved 15 Mardi 2007, from 
http://www.nlectc.org/assistance/cybersciencelab.html; CSL, CyberScience Laboratory - History. 
Retrieved 15 Mardi 2007, from at http://www.cybersciencelab.com/_public/index.html 

175 The Department of Defense Cyber Crime Centre (DC3), 26 March 2004. Retrieved 15 March 2007, 
from http://www.dcfl.gov/DCFL.htm 

176 [2000] EWCA Crim 44 (26th May, 2000). 

177 [2004] EWCST 398(PC) (24 August 2005). 
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occasions the images were of young people, the sites clearly indicated that parental consent 
and coopération had been obtained...” 178 The court dismissed his appeals against decisions 
on his unsuitability to work with children and vulnérable adults. 179 These cases provided 
useful reference for researchers to collect materials on similar subjects. Thus, legal steps 
should be taken to protect legitimate academie activities. 


5.4 Misleading information and cybercrime research 

As already noted, there has been abundant literature on cybercriminal phenomena. 
However, if we turn to Babbie (1995), to ask whether there has been a long-lasting tradition 
or an established authority in this academie inquiry, a satisfactory answer still deserves 
decoding, to which neither tradition nor authority suffïciently contributes. 

In fact, cybercrime has long been puzzled by misleading information, with the sources 
ranging from journalists’ books and articles, politicians’ reports and testimonies, law 
enforcement’s bulletins, and researchers’ academie writings (Smith, Wall Street Journal, 8 
September 1998). Some of the most famous hoaxes include the printer-virus, the 
electromagnetic puise gun, pen pal e-mail, Russian virus 666, Clinton virus, etc. (Smith, Wall 
Street Journal, 8 September 1998), among which the “printer-virus” is the most frequently 
cited in proving the danger of cyber warfare. 

Misleading information greatly reduces the seriousness, précision, reliability, and validity 
of relevant achievements. It is necessary to be cautious in dealing with literature. However, 
the widespread misleading (and non-misleading) information, particularly that originating 
from authoritative individuals or institutions, will inevitably still play a décisive rôle. 

5.5 Conclusion 

This chapter briefly summarized my understanding about how the phenomenon of 
cybercrime has attracted universal attention from people in ail occupations. Cybercrime has 

17s ibid., paragraph 8. 

179 ibid., paragraphs 31 and 33. 


162 



become a focus of research in the criminal sciences dealing with criminals. The topic of 
cybercrime covers a broad range of matters. As a new topic, many problems hâve to be solved 
first of ail in the theoretical sphere, supplemented by practical expériences. The research into 
this thème also relies on infonnation Systems. Although cybercrime concerns two groups of 
people: criminal actors and anti-crime actors, I am not devoting myself to describing how 
criminals leam from precedents to improve their criminal skills. Rather, the next chapter will 
return to criminal phenomena itself, observing the perpetrators from an external standpoint. 
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CHAPTER 6. CYBERCRIMINALS AND THEIR MOTIVES 


6.1 Introduction 

The motivated criminal is one of a causal trinity (together with the potential victims and 
weak guardianship) that produces crimes (Cohen and Felson, 1979). In cybercrime, this is 
also a perceivable reality. While we consider that the three factors are intertwined together, 
we will dedicate this chapter particularly to depicting cybercriminals and their motives. 

One of this study’s primary aims is to présent a panorama of the cybercriminal 
phenomenon necessary for the establishment of a positive argument for an innovative legal 
framework. It is crucial to answer the questions of “who are more likely to commit 
cybercrime,” and “what factors are more likely to motivate the cybercriminals to take the 
risk?” Studies and research on the subject of computer crime has had a history of several 
décades. Previous studies hâve drawn clear and steady conclusions that there was no single 
profile of the characteristics of a “typical” computer criminal, and that many whose 
characteristics meet the profile are not criminals at ail (Ware, Pfleeger and Pfleeger 2002, p. 
20). However, some profiles are built on empirical studies. The earlier studies tended to 
“portray them as young, educated, technically competent, and usually aggressive,” as Bequai 
(1978, p. 4) stated. Donn B. Parker (1976, p. 45) has presented a brilliant portrait of computer 
crime perpetrators, stating that they were typically “bright, eager, highly motivated, 
courageous, adventuresome, and qualified,” which were the just characteristics that qualify 
them to employment in data processing. 

The development of computer technology has changed the depiction completely (Becker 
1981, pp. 18-20). There are different views about the computer Systems, implying that people 
can use this System to do different things, and particularly, abuse the System, or pursue other 
déviant behaviours under the cover of technological challenge (ibid., pp. 18-20). Bequai 
(1983, pp. 47-50) found that while the potential sources of computer attack may vary from 
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each other, they can, however, be grouped into three categories: dishonest insiders, outsiders, 
and users. This implies that everyone had an equal chance of being involved in computer 
crime in the âge when the Internet did not expand as widely as at présent. Wasik (1991, pp. 
60-65) concentrated on the characteristics and classifications of perpetrators as well. 
Levinson (2002, p. 525) sorted out the sources of cyber threats into five groups, including 
insiders, hackers, virus writers, criminals groups, and terrorists. Reynolds (2003, pp. 58-65) 
classified perpetrators into hacker, cracker, insider, industrial spy, cybercriminal and cyber 
terrorist. That is to say, a broad application of computers had created a multi-dimensional 
social environment, and potential computer criminals had inevitably discovered the 
opportunities available. It is clear that the subjects of cybercrime will develop into typologies 
that are more and more sophisticated. 


6.2 The subjects of cybercrime 

When we talk about the subjects of cybercrime, the focus is on the profile of the 
cybercriminal. However, the cybercriminal is not one single person, but a group of 
perpetrators. Many researchers hâve written in previous literature about “who” are most likely 
to commit cybercrime. Any conclusions drawn from some hundreds or thousands of cases 
may be prématuré or misleading in formulating an accurate description of a profile. More than 
twenty years ago, Bequai (1983, p. xviii) pointed out that the problem of the computer 
criminal profile can be so complex that no one single picture can be given for sketching out 
the panorama of this aggregation. He gave a tentative table of the profile of a typical computer 
perpetrator concluded from hundreds of cases in the U. S. Bureau of Justice statistics (1983, 
pp. 42-45). He gave the same waming against a misleading effect as many other scholars did. 

As I concluded in the last chapter, the subjects of cybercrimes can be either insiders or 
outsiders. Many cases hâve revealed that insiders constitute a great threat to their employers’ 
Systems. However, fewer younger juvéniles are employed than older juvéniles. That is to say, 
the younger juvéniles may be found among the increasing number of outsiders who engage in 
cybercrimes. On the other hand, the nature of cybercrime is such that its perpetrators do not 
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hâve an âge limit. Any one who has access to computers and the Internet can act in a manner 
that gives rise to criminal liability. 

The Internet users are strongly sex divided, that is, a higher percentage of males than 
females use the Internet. For example, in 2001, only 6 per cent of Internet users in the Arab 
States were women. It is 38 per cent in Latin America; 25 per cent in the EU; 37 per cent in 
China, 19 per cent in Russia, 18 per cent in Japan, 17 per cent in South Africa, and nearly 50 
per cent in the U. S. In Nordic countries, males hâve a higher percentage of daily and 
regular use of the Internet (Nordic Council of Ministers 2005, p. 42, Table 2.5; p. 42, Table 
2.6). However, the différence is becoming smaller, with females constituting the larger group 
of Internet users in some countries. 

This character is also transplanted into cybercriminal phenomena. According to Levinson 
(2002), “It is well established that boys commit far more juvénile crime, particularly violent 
crime, than girls.” (p. 490) In fact, males hâve historically been responsible for the majority of 
overall criminal phenomena. Even in modem society, females constitute only one-third of 
those who commit ail crimes. For example, in 2005, among the suspects investigated by the 
Finnish police, only 17 percent were females (Honkatukia and Savolainen 2006, p. 189). In ail 
the offences, the highest percentage that female suspects account for are still below 30 percent 
(ibid., pp. 189-190). Similar patterns hâve also been demonstrated in many other countries. 181 
Cybercrime seems less violent, but research studies indicate that more males commit 
cybercrimes than females. In a Chinese statistical study, Jiang (2000) found that males 
accounted for 91.45 percent of the perpetrators, while females accounted for only 8.55 percent 
(pp. 151-152). He explained that the reason might be the différences between males and 


lsn Women’s Learning Partnership, December 2001. Retrieved 15 Mardi 2007, from 
http://leamingpartnership.org/facts/tech.phtml 

1S1 Take example of other Nordic countries: in Norway, females constitute less than 15.3 percent of 
persons charged with crimes (Norges Offisielle Statistikk. 2007. Kriminalstatistikk 2002 (Crime 
Statistics 2002) (NOS D 374), Table 14: Persons Charged with Crimes, by Sex and Age, p. 45); in 
Sweden, the percentage is about 19.7 (Sveriges Officiella Statistik. 2005. Brottsfbrebyggande Râdet, 
Tabell 200: Persons Suspected of Offences by Types of Offence, Age and Sex. Retrived 15 Mardi 
2007, from http://www.bra.se/extra/measurepoint/?module_instance=4&name=Persons suspected of 
offences, 

2005&url=/dynamaster/file_archive/061003/37fd76d9cl5c0f2el 8648590184d55cb/Persons%2520sus 
pected%2520of%2520offences%25202005.xls); in Denmark, the figure is around 17.6 (Statistics 
Denmark. 2006. Statistics Yearbook 2006, Social Conditions, Health and Justice, Table 193: 
Convictions for Offences against the Penal Code, by Age and Sex 2004). 
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females in computer knowledge, skills, and attitudes to online interactions (ibid.). However, 
the reasons why females hâve been convicted of fewer cybercrimes than males are not really 
clear at ail. The matter needs a spécial exploration into questions of whether females actually 
do commit fewer cybercrimes or whether female cybercriminals are less able to be detected. 
While sex is natural, gender is social. In current society, particularly in cyberspace, the 
boundary between (virtual) genders is vague. Thus, considérable efforts of the imagination are 
now being made about how genders should be defined. 

Another characteristic of the subjects is that they are distributed over a broad area. 
Where there is Internet, there are users, and there are opportunities for abusers. Interaction 
and communication become more convenient, and conspiracy may take the form of online 
communications. Online gangs and organized crimes are capable of launching attacks from a 
wide range of computers. In talking about the global distribution of cybercriminals, we are not 
denying the global distribution of traditional criminals either. Any criminal can commit a 
cybercrime across territorial borders without appearing in person at the crime scene, which is 
a necessity in almost ail the traditional offences. The cybercriminals stay where their 
computer hardware is located, while at the same time their criminal activities can take place 
wherever infonnation Systems exist. 


6.3 The background of the cybercriminals 


As stated, computer crimes can be divided into offences by insiders and offences by 
outsiders. Shaw, Ruby and Post (1998) classified insiders into infonnation technology 
specialists such as full-time or part-time employées, contractors, consultants, or temporary 
workers; partners and customers with System access; and former employées retaining System 
access. As to whether it is insiders or outsiders who constitute the greater threat to the 
computer System, there hâve been different findings. 182 However, the mainstream findings 


182 For example, The AFCOM's Data Centre Institute found that the cyber attacks launched by 
outsiders (52 percent) were ten times that of the insiders (5 percent). However, the respondents were 
more concerned the insider threats than the outsider ones. See Edward Hurley, Are Insiders Really a 
Bigger Threat? 17 July 2003. Retrieved 15 March 2007, from 
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prove that insiders hâve been more likely to be involved in computer crimes against the 
employers’ Systems or other abuses. 183 Insiders and outsiders also form conspirators in 
certain schemes (see also Section 4.9.4). 184 The Nordic Council of Ministers (2005) found 
that students, employées and self-employed people constitute a higher percentage of Internet 
pénétration (Nordic Council of Ministers 2005, p. 42, Table 2.5). 

In addition, there is a spécifie category of attackers, namely, “outside insiders.” They are 
those who were previous employées but later left the occupations. Being former employées, 
(some even being computer administrators), they had knowledge about the inside structure of 
the institution’s information Systems, and some even kept their accounts for access to the 
computers of the institution. Leaving the previous occupation, they became outsiders, but 
with a higher possibility than pure outsiders to misuse the institution’s information Systems. 
The reasons why they left the occupation are closely linked to their motives in the attack. 185 

The conspiracy between the insiders and the outsiders is an issue that cannot be ignored. 
Particularly, the co-operation between insiders and the above-mentioned outside insiders are 
always closely connected with an established relationship, an environment of corruption and 
indiscipline. In R. v. Rees, 186 a previous colleague of the accused was convicted of 
inappropriately disclosing to the accused confidential information of the police, and thus 
inappropriately enabled the accused to hâve such confidential information in his possession, 


http://searchsecurity.techtarget.com/originalContent/0,289142,sidl4_gci906437,00.html 

183 For example, in R. v. Stanford ([2006] EWCA Crim 258 (01 February 2006)), after the perpetrator 
resigned from leadership of the company, he retained a 30 percent shareholding. In order to regain his 
position, he began to collect information to discrédit the leader and force him to resign. By using the 
name and password of an administrator of the e-mail server, he intercepted the e-mails of the server. 
Another example, United States v. Pierre-Louis (Southern District of Florida No. 
OO-434-CR-GOLD/SIMONTON, 22 Mardi 2002), an employée (the accused) sent a virus to his 
employer, and caused a two-day stoppage. 

184 In R. v. Jones and Singh ([1997] EWCA Crim 164 (23 January 1997)), three co-accused, who 
worked for the National Westminster Bank, produced screen prints of confidential information of 
genuine customer accounts. They passed the printouts via middlemen to the co-accused, who in tum 
used to forge crédit cards. The forged crédit cards were used to defraud from the bank of £1.2 million. 

185 For example, in United States v. Middleton (Ninth Circuit No. 99-10518, 12 September 2000), the 
accused dissatisfied with his job as a computer administrator in a company and quit, with extensive 
knowledge of its information Systems. He was allowed to retain an e-mail account and used it to 
commit his unauthorized access and sabotage; in the United Sates v. Millot (Eighth Circuit No. 
04-3962, 15 November 2005), the former System analyst of a company quit the post, but retained a 
Secure ID card of an account with the highest level of access possibility. With this, he repeatedly 
accessed the company's network and caused damage. 

186 [2000] EWCA Crim 55 (20 October 2000). 
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while the accused was convicted of aiding, abetting, counselling or procuring his colleague to 
do this. 

Conspiracy not only happens between insiders and “outside insiders” (see also Section 
4.9.4). Pure outsiders are also likely to participate in it. In R. v. Allison, 187 the accused was 
an insider, who acted as a credit-card analyst, having the authority to access information 
about the company’s debtors. She got instruction on accounts that she should work on, but 
she could also access other accounts. Upon accessing other accounts, she provided 
information about them to her outside co-conspirators. With that information, one of the 
outsiders drew large sums of money from Automatic Teller Machines (ATM). 

Mackenizie and Goldman (2000) reported that some students, particularly computer 
science and engineering majors, with newly discovered skills, attempted to break into the 
servers of the University of Delaware (p. 174). CSI reported that 55 percent of survey 
respondents reported malicious activity by insiders (Nelson 2004, pp. 299-321). Researchers 
also revealed that dissatisfïed employées were a major source of computer crimes (Vatis 
1999) and were the greatest threat to computer security (See Sinrod and Reilly 2000, pp. 
183-187). When Sutherland suggested the term “white-collar crime” in the late 1930s, he 
could hardly hâve imagined that there would be crimes occurring in the process of 
human-machine-human interaction, other than the human-human interaction, 
human-organization interaction, or human action against the machine. Nevertheless, the term 
“white-collar cybercrime” or “cyber white-collar crime” has also corne into use at the présent 
time, apparently as new development of Sutherland’s theory. 188 Michalowsky (1996) 
explicitly attributed computer crime to white-collar crime (p. 175), because computer crime 
was an “insider crime” (p. 177), computer crime violated “trust” (p. 178), computer crime 
aimed at “personal or organizational enhancement” (p. 179), computer crime was 
“administratively segregated” (p. 180), and computer crime drew “limited enforcement 
attention” (p. 181). 


187 [1998] EWHC Admin 536 (13 May 1998). 

188 See for example, “Victim Assistance Online” Web site. Retrieved 15 March 2007, from 
http://www.vaonline.org/internet_wcollar.html. The term “White-collar Hacker” is also used, for 
example, by Leyden, J. The Rise of the White-collar Hacker, 2004. Retrieved 15 March 2007, from 
http://www.theregister.co.uk/2004/03/31/the_rise_of_the_white/ 
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In my opinion, the concept of white-collar crime cannot perfectly fît the situation of 
cybercrime. Yet the term “white-collar crime” emphasizes the occupation and social status of 
the criminals, and one of the most relevant factors in white-collar crime is the knowledge that 
the criminals acquire from both their pre-employment éducation and their occupational career. 
It is hardly oversimplified to view white-collar crime as a knowledge-based offence 
compared with violence-based traditional offences. As to the defining of cybercrime, it can 
be viewed either as a knowledge-based white-collar crime or as knowledge-based cyber 
violence. In the former case, it is white-collar crime; in the latter, it is not. 

It is reasonable to conclude that, when there were few computers, employées in 
computer-related industries were the only computer users, and were small in number. They 
acquired more chances to launch attacks against their employers. With the prevalence of 
Personal computers and the development of the Internet, insiders remain to take advantage of 
having better knowledge about access-control mechanisms, asset management Systems, and 
overall loopholes. Insider knowledge, convenience, and directness encourage undisciplined 
employées to commit cybercrimes. As the U. S. Secret Service and CERT Coordinator 
Centre's study disclosed, minimal technical skill is required to launch cyber attacks on the 
banking and finance sector (Randazzo and co-workers 2004). 189 

In addition, insiders expose themselves to a négative psychological influence derived 
from their information work environment. Shaw, Ruby and Post (1998) identified the factors 
that increase the tendency towards illegitimate and harmful behaviour among employées, as 
including computer dependency, a history of personal and social frustrations (especially 
anger toward authority), ethical flexibility, a mixed sense of loyalty, entitlement, and lack of 
empathy. 

On the other hand, offences by insiders involve a less complicated process of tracing, 
detecting and investigating than in the case of outsiders. If we cannot judge whether insiders 
or outsiders are liable to commit more cybercrimes, we should firstly consider the question of 
which group are more likely to do it and which group are more likely to be caught. Insiders 
surely coincide in both of situations: insiders commit it and they are caught. There fore, 

ls9 In different studies, the term “insider” is defmed differently. In Randazzo and co-workers (2004), 
insider was defmed as including “current, former, or contract employées of an organization.” 
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everyone knows that insiders pose greater threats, and outsiders are exempted from 
reprimand. Furthermore, it is more efficient for the law enforcement to reveal an inside 
misuse than an outside attack, they are rationally more likely to pay more attention to the 
current and previous employées. Incidents involving outsiders and or international actors will 
more likely to be disregarded at flrst glance. 


6.4 Individuals versus groups and organizations 

The social actors can roughly be classffied into two categories, natural individual actors 
and corporate actors (Coleman 1990). The classification has been used to categorize 
criminals into individual criminals and corporate criminals, for example, Sutherland (1949), 
Alvesalo and Laitinen (1994, pp. 11-66), etc. 

The subjects of cybercrime -in this case the perpétra tors- are as complicated as those of 
traditional crimes. We can touch further beyond the idéal typology for a combination of 
individual persons. First, individual persons act independently, in which case the perpetrator 
should necessarily appear on the scene. 

Second, individual persons act separately, but dependently, for example in cases of 
mobs and other collective actors, in which the actors necessarily appear on the scene, and 
their absence is exceptional. 

Third, individual persons act together. They are dépendent, interrelated, and coordinated 
as in the case of organized crime. They do not necessarily act physically in person. When an 
offence is committed, some are on the scene, while some are not, for example, the organizer 
of the crime. A collective presence is optional. 

Fourth, individual persons act together. They are dépendent, interrelated, coordinated, 
but not necessarily physically in person. A collective presence is exceptional. 
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Figure 5 The Forms of Criminal Actors and the Préventive Units Designed against 

Them 


Notes: 

The first two types are non-organized. The latter two types are organized. 

The first three types are illegitimately combined. The last type is legitimately combined. 

As Figure 5 illustrâtes, an individual belongs to a single non-collective class. However, 
the individual also belongs to the group of the non-organized class. Furthennore, the 
individual, group and organization belong to the same non-institutionalized class. The 
organization and corporation both belong to the organized class, but the corporation is further 
located in the institutionalized class. In addition, the criminal group and criminal organization 
are both criminal collectives, being illegitimately formed. The corporation is formed 
legitimately. 

Extending the discussion a little further. The individual is directly linked to the family. 
Group is usually beyond one family, but is limited to the neighbourhood. Organized crime 
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has a broader range of influence, that is, the community. These three units can play important 
rôles in crime prévention against the individual, group, and organized crime both separately 
and together. A corporation is established by the authorization of the State, and the primary 
prévention unit should be the public sector. 

As Kelly (2002) has summarized it, cybercriminals may be those who shift from 
traditional crime into a new world, discontented personnel, cyber adventurers, and cyber 
spies and cyber warriors. 190 It is reasonable to claim that these individual criminals, 
corporate criminals, and particularly, a criminal organization ail hâve the tendency to extend 
their criminal activities into cyberspace. Sometimes even cyber mobs will act against law and 
order in cyberspace. 

In the case of natural persons, the social status, âge, and éducation background of 
computer criminals cover a broad range. They may be “students, amateurs, terrorists, and 
members of organized crime groups” (UNCJIN 1999, Paragraph 32); or people with varied 
skills, knowledge, resources, authority, and motives (Parker 1998); and people with different 
levels of skill in formai éducation, social interactions and use of computer Systems (Parker 
1998). Particularly, virus writers also “vary in âge, income level, location, social or peer 
interaction, educational level, likes, dislikes and manner of communication.” (Kabay 2001) 

If we say that cybercrimes by individuals hâve already run rampant, organized 
cybercrime, cyber terrorism, and cyber laundering will be even greater emerging threats to 
the networked information society. 

The 9/11 attacks on the U. S. raised great concern about organized cybercrimes, cyber 
terrorism and cyber laundering. Although many commentators hâve made efforts to delinc 
organized crime, Feldman (1993) has identifïed three key features of such organizations: 
making money as the goal; corrupting the police and public officiais; and being a family 
business (p. 16). In this sense, no organized cybercrime has ever been reported in real life. 
Although organized cybercrime can be regarded as falling within the domain of actions of 
natural individual criminals, it has such particular properties that it deserves a spécial inquiry. 

190 Kelly (2002) stated that: “Perpetrators can be from the traditional criminal world exploiting the 
power of the new tool, disgruntled employées using their inside knowledge, the curious and 
thrill-seekers treating the medium as a challenge and those engaged in industrial espionage and 
information warfare.” 
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Information Systems hâve dual rôles, being a critical infrastructure of society and 
potential targets for crimes; and being the means as the communications System and being the 
route that facilitâtes electronic-money laundering. A growing concem is that the organized 
crimes and cybercrimes are increasingly interwoven. Bequai (1979b, p. 201) stated: 
“Organized crime now opérâtes with impunity and the knowledge that it enjoys de facto 
immunity from prosecution.” The computer Systems is infiltratcd by organized crime (Bequai 
1983, pp. 55-69), becoming its tools to operate drug trafficking, gambling, loan sharking, 
theft of cargo, prostitution and bootlegging of cigarettes, labour racketeering, coercive 
practices, and économie crime (p. 59). Everything that traditional organized crime has been 
doing can now possibly be done with the help of information Systems, which play different 
rôles in offences. 

The ways in which international organized criminals exploit information Systems, 
including making obstacles by technical means to escape official investigations, raising funds 
through cyber offences, using online services in money laundering, publishing online 
advertisements, and realizing trans-border money laundering through electronic banking and 
commerce Systems (Lilley 2003, p. 117). Williams (2001) identffied that criminal groups are 
using the Internet in property crimes, white-collar crime, and money laundering, and the 
organized crime groups that use the Internet for communications and for any other useful and 
profitable purposes. 

Most cybercrimes are not necessarily organized; however, organized forms of 
cybercrimes hâve greater threats than unorganized fonns. Organized crime simply means a 
crime that is committed by organized perpetrators. In the case of cybercrime, there are some 
forms of offences like organized crime, but in practice, they are merely individual crimes. 
For example, distributed déniai of service attacks are launched from compromised computers 
distributed in different locations. These computers can be “organized” by one or more 
persons. However, the crime in which “organized” computers are used as tools does not 
necessarily fonn an organized crime. 

The U. S. Department of Justice (2002) reported an organized software piracy case. 
According to the report, the DrinkOrDie online software piracy group was specialized in 
acquiring and cracking new software and releasing cracked software over the Internet. The 
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leader and about 65 members from more than 12 countries in the group adopted a 
hierarchical organizational structure, grouping members according to their different functions 
(U. S. Department of Justice, Press Release, 17 May 2002). 

In considering the problem of organized crime, the UN Convention against 
Trans-national Organized Crime should not be ignored. The Convention defines organized 
criminal groups as “a structured group of three or more persons, existing for a period of time 
and acting in concert with the aim of committing one or more serious crimes or offences 
established in accordance with this Convention, in order to obtain, directly or indirectly, a 
financial or other material benefït.” 191 For how long a period of time the group exists has not 
been clarified in the Convention, while serious crime means a crime punishable by at least 
four years of imprisonment. 

Although there is increasing concern on cyber terrorism, the understanding of what 
cyber terrorism constitutes is unclear. Generally, it is a concept that is comparable to 
traditional terrorism. Many characteristics can be induced from the concept “terrorism”; 
however, the most significant factors may be political motivation, violent effect and fear 
création. The following two définitions prove that these respects are also critical in 
identifying “cyber terrorism”. The FBI’s définition of cyber terrorism has emphasized the 
political motivation and the violent effect in an attack on information Systems: 

“The premeditated, politically motivated attack against infonnation, computer Systems, 
computer programmes, and data which resuit in violence against non-combatant targets by 
sub-national groups or clandestine agents.” (Pollitt 1997, Cited in Robert 2004, p. 124.) 

The U. S. National Infrastructure Protection Centre’s définition has focused more on the 
fearful effect of such an action, among many other harms: 

“A criminal act perpetrated by the use of computers and télécommunications capabilities, 
resulting in violence, destruction and/or disruption of services to create fear by causing 
confusion and uncertainty within a given population, with the goal of influencing a 
govemment or population to confonn to a particular political, social or ideological agenda.” 
(Garrison and Grand 2001, p. 2) 

As Weimann (2004, p. 6) claimed cyber terrorism becomes an attractive choice for 
191 The UN Convention against Transnational Organized Crime (A55/383, 2000), Article 2. 
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contemporary terrorists for several reasons. It is cheaper, more anonymous, aiming at a more 
enonnous target and number of targets, remotely conducted, and affecting a larger number of 
people worldwide. International society has hardly implemented any countermeasures against 
traditional terrorism in the last few years. At présent, furthcr actions should be taken to 
respond to the rising threat of cyber terrorism. However, from lack of practical cases, cyber 
terrorism remains a theoretical assumption and a supposed or partial threat. Scholars, 
politicians and mass media tend to connect terrorists with information Systems, but these 
efforts appear feeble since the fact that the terrorists are still able to utilize the traditional post, 
transportation, and Courier. As Harvey (Financial Times, 3 December 2003) pointed out, 
cyber terrorism remains an unnnportant matter. 

Theorists of the early 2000s overemphasized the problem of cyber terrorism for several 
reasons: Firstly, the panic caused by the previous century’s Asian financial crisis continued in 
the uncertain new century. Secondly, the déniai of service attacks against web sites during 
this period seemed to portend the possibility of the collapse of information Systems and the 
information economy. Thirdly, for the mainstream American theorists and law enforcers, the 
9/11 attacks on the U. S. were interpreted as a strange hint that cyber terrorism could also 
cause similar casualties in which thousands of people lose their lives. Fourthly, 
eschatological ideas still dominated the brains of most people in considering that the end of 
the world may be expressed in the form of end of the society, in particular, the information 
society. 

The research on cyber terrorism is primarily for the purpose for raising the awareness 
and preparedness of the authorities (because once occurring, cyber terrorism should be dealt 
with at the flrst moment by the authorities), the législature, politicians (because it is 
politically motivated) and the general public (because it is assumed that the general public are 
the most frequent victims, even if the attack is targeted at a certain person, building, vehicle, 
or certain part of information Systems). 


192 The présent wars on real world terrorism being continued, critics revealed that the wars are based 
on “selfish” politicians’ distortion and exaggeration of the threats posed by terrorism. See Stewart 
Nushbaumer, The Abuses of 9/11, 2002. Retrieved 15 Mardi 2007, from 

http://www.911digitalarchive.org/collections/reports (saying that the wars were being exploited by the 
forthcoming party élections); DeBose (2004); O'Brien (2004) (saying that the so called war on 
terrorism included “inexcusable misrepresentation”). 
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6.5 Juvénile cybercrime 


A noteworthy phenomenon is that, regardless of individual cybercrimes, or corporate 
cybercrime, young perpetrators play a critical part. Although there is no âge limit for 
committing the cybercrime, as there is for traditional crimes, young people constitute an 
important part of the cybercriminals. As Shannon (1993, p. 2) reported, cybercriminals 
usually tend to be between the âges of 14-30, they are usually bright, eager, highly motivated, 
adventuresome, and willing to accept technical challenges. The âge of criminal responsibility 
is prescribed differently between various countries. In most countries, children under 14 or 
15 years of âge are not liable for a criminal offence, while children between 15-17 or 14-16 
years of âge are liable for a limited range of offences. 193 In fact, juvéniles commit a number 
of these crimes. In China, people between the âges of 19-40 constitute 80 percent of the 
Internet users, and the average âge of the cybercrime perpetrators is 23 years old (Dong 
2003). Juvénile delinquency and juvénile justice became issues closely associated with 
cybercrime. According to Howitt (2002), the reason why children are more likely to commit 
crime is not that more and more children will commit crime, but that most of the potential 
offenders will commence to commit crime in childhood and continue their criminality for 
much of their lifetime. After 16-17 years of âge, the offending rates decreases to a plateau (pp. 
76-77). Through empirical studies, the following reasons show why juvéniles hâve a greater 
tendency to commit more cybercrimes: 

(1) People of different âge groups use computers and networks in a different 
environment. Adults usually use computers and the Internet at work. When they go home 
after work, they hâve to do housework, take care of children, or are engaged in sports and 
récréation. The youths, including young couples without a child, use computers and the 
Internet at any time, and for a long time everyday. For example, about 57.9 percent of the 

193 For example, in China Penal law, children under 14 years old of âge are not liable; in Finish Penal 
law, the âge limit is 15. In some other countries, the âge of criminal responsibility is even lower. In 
England and Wales, the âge is 10 years, while the there is a partial criminal responsibility between 
10-14 years of âge. 
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Internet users are unmarried (China National Networks Information Centre, Statistical Survey 
on the Internet Development in China 2006, pp. 14-15). Many of them are not employed. In 
addition, some of the employed also use computers and Internet for many hours in their spare 
time. Students and employées in enterprises constitute 64.8 percent of the Internet users (ibid., 
p. 16). Youths use computers and the Internet for purposes of éducation, communication and 
récréation. Chatting and gaming are the commonest forms of online activities. Offline dating 
with online mates has become popular. Of the 111 million Chinese Internet users in January 
2006, about 16.6 percent are under the âge of 18, about 35.1 percent are between 18 and 24, 
about 19.3 percent between 25-30, about 11.6 percent between 31-35, about 7.1 percent 
between 36-40. Users older than 41 account for only a little more than 10 percent (ibid., pp 
12-13). The U. S. Census Bureau surveyed households with computers and Internet access by 
householder âge. The findings indicate that the 35-44 and 45-54 âge groups hâve the highest 
pénétration, more than seventy per cent own a computer and over sixty-livc percent had 
Internet access. The survey found that the critical factor in detennining whether a household 
had a computer or Internet access was the presence of a school-age child. 194 

A similar characteristic has also been found in Finland where one parent or two parents 
with children hâve access to the Internet at home with a higher percentage (Nordic Council of 
Ministers 2005, p. 39, Table 2.2). In ail of the Nordic countries, the âge groups of 25-34, 
16-24, 35-44, and 45-54 hâve the higher pénétration percentage (ibid.). This increases the 
opportunities for hanning others and the probabilities of being victimized. 

(2) People of different âge groups hâve different interests in using computers and 
networks. The adults devote themselves more to profession and family, apart from the fact 
that their energy and interests are more concentrated on issues of greater concem. Youths are 
neophiliacs, with sharper curiosity and passion for an unknown field, and more hobbies. 
According to the Nordic Council of Ministers (2005), with an increase in âge, the use 
purposes of the Internet déclinés. Youths use the Internet in noticeably more varied ways than 
elderly people do. Sixty percent of people under 30 years of âge and exactly 14 percent of 
people from 60 to 74 years of âge find at least eight purposes to use it (Nordic Council of 
Ministers 2005, p. 36). The Mentor, the author of “the Hacker Manifesta” confessed that: 

194 U. S. Census Bureau, Computer and Internet Use in the United States: 2003, published in 2005. 
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“Mine is a world that begins with school... I'm smarter than most of the other kids, this crap 
they teach us bores me..,” 195 The youths are also prone to addict themselves to computers, 
the Internet, and virtual reality. The Mentor described that: 

“And then it happened... a door opened to a world... rushing through the phone line like 
heroin through an addict's veins, an electronic puise is sent out, a refuge from the day-to-day 
incompétence is sought... a board is found.” 196 

The share of virtual life in their daily life is increasing, at the share of real life decreases. 
To the extent the youths spend more time in cyberspace, the bigger the probability is that 
they involve themselves in online illégal activities (besides legal ones). 

(3) People of different âge groups hâve different structures of knowledge, techniques 
and skills on computers and networks. The adults generally grasp the knowledge, techniques 
and skills for their occupational use. This does not exclude that they were ever good at 
pre-Windows operation Systems and interfaces, for example, MS DOS, etc. However, adults 
hâve less intention of exploring the higher techniques and skills on computers and Internet, 
particularly those irrelevant to their profession. The young people are motivated by their 
curiosity and engaged in “learning-trying”. They are willing to try either useful or harmful 
content, programmes, messages or activities. They easily act in a way that sometimes 
generates a legal concem. 

(4) People of different âge groups hâve a different legal consciousness and sense of 
social responsibility. The adults are more socialized and hâve a higher level of legal 
consciousness and stronger sense of social responsibility. They are not willing to harass 
others or disturb the public. Youths are in the process of being gradually socialized, with 
lower level of legal consciousness and a weaker sense of social responsibility. In practice, 
many juvénile cybercriminals are not conscious of the nature of their harmful activities. They 
think more about themselves than about the public, more about process than about resuit, and 
more about the power of technology than about the négative influence. They just do not 
recognize the harmfulness of their dangerous behaviour before they attract the attention of 
the law enforcers. 

195 The Mentor, The Hacker Manifesta, 8 January 1986. 
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(5) People of different âge groups hâve a different risk calculation and expectations of 
costs in deciding whether to carry out cybercrime. Adults who hâve their stable professions, 
families, réputation, and social status are not likely to carry out more risky and more costly 
activities, particularly harmful hacking. They feel they can only benefit far less from illégal 
activities than engaging in legal activities, and thus hâve less incentive to hack. If they 
commit this kind of act and are caught, their losses will be great and in a broad range. The 
possible resuit deters them from acting with a négative social and legal évaluation. Young 
people generally hâve a less stable social status and less to lose if they are caught for hacking. 
Their incentive to hack is surely bigger than adults are. 

(6) People of a different âge group hold different attitudes toward crime. Adults hâve 
more mature thinking about criminal phenomena. The hannfulness and risk of crime hâve 
impressed them to stop before crime at every moment. Youths are not as mature as adults are 
and are less capable of controlling their enthusiasm. The temporary impulsion usually results 
in irrecoverable activities. 

(7) People of different âge groups demonstrate different fluidity. The personality 
development of the adulthood is characterized by stability: “stability is the rule.” (Smith 1998, 
p. 397) Adults are apparently more stable than youths in employment, families, social status, 
and réputation. The youths are in a situation of development and usually move from here to 
there. During this process, they are easy to hâve more spare time alone. Due to lack of 
acquaintances, they take part in traditional social activities less but in online interactions 
more. In particular, in régions in the process of urbanization, the existence of latch-key 
children provides an incentive for private enterprises to operate premises for access to 
network services and gaines, these becoming largely uncontrolled places so that 
undisciplined children engage in unmonitored activities. 

(8) People of different âge groups hold different attitudes toward fortune and fate. 
Adults hâve more life expériences and social knowledge, and are more aware that criminals 
can escape punishment temporarily, but that mostly they will be caught and punished later. 
Young people hâve a more unreasonable imagination of being able to escape from law 
enforcement, particularly when computers and the Internet provide such an indirect way of 
carrying out a criminal scheme. 
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(9) Criminal-victim relations are easier to establish between online users. Because 
youths tend to use computers and the Internet in a more frequent way, both cybercriminals 
and cyber victims tend to be people inside this âge group. The same rule can be applied to 
organizations. Although it is unfeasible to measure the âge of an organization, the âges of the 
personnel may serve as an indicator of the online business of this organization. If a company 
is owned or managed by youths, it is more likely to engage in some kind of online business, 
and more likely to be victimized as well. 

(10) Young people more easily escape arrest and punishment than adults are. This does 
not mean escaping in the physical sense, that is, “to run”. Rather, young people are less stable 
and fixed in terms of social status, and may hâve better chances of avoiding arrest by moving 
firom one place to another, without further responsibility for employment or family (if they 
are not employed or married). 

In sum, youths may hâve more chances for access to computers and the Internet and are 
more likely to commit cybercrime. Certainty, they more easily harm others and are 
themselves more easily victimized. 


6.6 The subjective aspects of cybercrime 

Cybercriminals hâve a multiplicity of motives. The prolific functions and services of 
information Systems create diversified incentives for their users to commit crimes. Criminals 
can be satisfied physically or psychologically through various online offences. As I hâve 
summarized the matter in the last chapter, cybercriminals can be motivated by a broad scope 
of internai driving forces. Cybercrime becomes an attractive industry for those who are 
seeking profitable opportunities. 

The perpetrators do not hâve a particular sense of guilt. The absence of the traditional 
crime scene and the remote control of the process render things different from the traditional 
crime scene. Technological involvement makes the process of most cybercrimes less violent. 
This results in a réduction of ethical and legal responsibility and of psychic cost, and créâtes 
an incentive to start, continue and repeat the offences. 
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The perpétra tors dépend more on fluky éléments. As will be discussed in depth in 
Chapter 7, information Systems provide chances for criminals to conceal their criminal traces 
and make it difficult for them to be discovered. The easy escape from moral pressures and the 
difficult détection process lower the psychic cost and increase the psychic sense of security. 
As the Hacker Manifesto stated that: “You may stop this individual, but you can’t stop us 
ail ...” 197 The deterrent effect of punishment on the cybercriminals is in turn reduced. More 
potential perpetrators are thus encouraged to participate in unlawful online activities. 

Furthermore, the Internet créâtes a space where people are not meeting face-to-face, but 
meeting mind-to-mind (Hagerty 2000, p. 181). The cyberspace facilitâtes a new style of 
interpersonal interaction that develops through the médiation of machines beyond the physical 
appearance of the participants. However, minds under this easy sense of falsification can only 
develop a vulnérable relationship and expose potential victims. E-mail firauds and viruses are 
a source of exploitation harvesting from the blind trust of remote récipients, enmeshed in the 
so-called social engineering structure. In Tektrol Limited v. International Insurance Company 
of Hanover Limited and Great Lakes Reinsurance (UK) Limited, 198 an attachment of an 
e-mail purported by a Christmas card from a trustworthy source was activated by the récipient 
and erased System files on the computer causing it to cease functioning, and more seriously, 
erased the source code that the récipient company developed. 199 


6.7 The motives of cybercrime 


As discussed in Chapter 5, cybercriminal behaviour affects many scientific disciplines. 
In research on cybercrime, the term motivation is used in a broad sense, and is usually 


197 The Mentor, The Hacker Manifesta, 8 January 1986. 

198 [2004] EWHC 2473 (Comm), No. 2003 folio 940. 

199 . The court noted that: 

“The viras author had no knowledge of or connection to the Claimant or its source code. 
Although he did not specifically intend to erase the Claimant’s source code, he intended the viras 
programme to spread around the world and knew that whenever the viras programme was activated by 
the opening of the ‘Christmas card’ attachment, computer data could be erased on the computer 
concerned.” 

ibid, appendix, assumed facts for the preliminary hearing, Paragraph 20. 
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interchangeable with motive. Motives are nothing more of a mystery than the wants and 
wishes the goal-directed activities endeavour to gratifÿ (Smith 1998, p. 422). A strict 
distinction cannot be made between these two words. Therefore, Maslow’s “need hierarchy,” 
which lists need in a order of priority as physiological needs, safety and security needs, 
belongingness and love needs, esteem needs, cognitive needs, aesthetic needs and need for 
self-actualization (Maslow 1954), is not consistently relevant with the analysis here. The 
forces behind the individuals’ decisions to commit cybercrimes are different from one 
another. In understanding cybercriminal behaviour, we hâve to recognize psychic benefit in 
some cases and for some people. Although it is difficult to find a motive behind a cybercrime 
(Philip 2002), many different studies and research hâve drawn diversified conclusions on the 
classification of the motivations. According to Jordan (1998), there are six cominon beliefs 
among hackers: addiction, curiosity, thrill of information searches, ability to access, peer 
récognition, and identifying security loopholes. Maiwald (2003, pp. 36-38) concluded that 
hacker motivations could be divided into three categories, including the search for challenge, 
greed, and malicious intent or vandalism. Kiger and co-workers (2004) hâve summarized the 
motivations of cybercrime as money, entertainment, ego, cause, entrance to social groups, 
and status. Pipkin (2002, pp. 17-28) proposed that hackers may hack from an intellectual 
motivation, such as educational expérimentation, harmless fun, as a wake-up call; personally 
motivated, such as disgruntled employées, cyber-stalking; socially motivated, such as 
cyber-activism; politically motivated, such as cyber terrorism, cyber-warfare; financially 
motivated; and motivated by the ego. Kremen (1998) classified hackers into ten types, 
including curious hacker, thrill seeker, the person who wants information about computers 
and their flaws, power seeker, vandal, the person who steals industrial information, secrets 
and/or intellectual property, the person who steals money, the person who performs industrial 
espionage, terrorist, and international spy (see also Section 4.9.2) 

In fact, the motives of cybercrime vary in a way that is beyond the imagination. If we 
say that many cybercriminals hâve the similar motives, we can also say that nearly every 
perpetrator has his or her own. Bequai (1983, pp 44-45) has summarized 17 different kinds of 
motives that propel the potential perpetrators to take the risk of committing computer crime. 
This section will identify and discuss 29 kinds of the commonest motives, without 
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deliberately avoiding coincidence with the different lists created by previous scholars. 

(i) Pursuing information freedom 

A firee flow of infonnation is a requirement for ensuring the firee movement of goods, 
persons, services and capital. 200 In cyberspace, people who hold the view that the Internet is 
a public place, and thus everyone has the right of obtaining information, are not rare. Under 
the dominance of the hypothesis of infonnation freedom, many infonnation Systems users 
take the risk of breaching others users’ privacy and trade secrets. Levy (1984), Selwyn and 
Gorad (2001), and Himanen (2001) hâve shown that many traditional hackers are motivated 
by a belief in the freedom of information. These hackers hâve insisted that ail the useful 
information must be freely copied, distribute, studied, changed, and improved, but their 
ethical code prohibits destructive activities against any information. 201 What is problematic 
is that unauthorized access to confidential data has been criminalized, even in pre-computer 
times. If e-mail is comparable to a letter, and if free information advocators can freely open 
e-mail, a natural conclusion will be that everyone can destroy mailboxes and open letters. 
The only différence is that the présent files exist in digital form. Access to confidential 
information is punished by laws penalizing offences infringing privacy, intellectual property, 
trade secret, and State secret. Therefore, the freedom of information is limited to information 
that is granted free access but access is not free to information that is limited. The other end 
of the free flow of information is the safeguard of the fundamental rights of individuals. 202 

(ii) Achieving ego expression 

Hackers also hâve the possibility of hacking for the sake of their ego, for proving a self 
that is different from the selves of others. Perpetrators in this category are usually frustrated in 
social compétition elsewhere and seek an opportunity to compensate by employing their 


Directive 95/46/EC, Preamble (3). 

201 See Branscomb (1990). The focus of the hacker ethic is on the freedom of information. The hacker 
ethic was initially created by the MIT hackers in the late 1950s to the late 1960s and articulated by 
Steven Levy in his book “Hackers: Heroes of the Computer Révolution.” The general creed includes 
the following aspects: “1. Always yield the Hands-On Impérative! Access to computers— and anything 
else which might teach you about the way the world works— should be unlimited and total. 2. Ail 
information should be free. 3. Mistrust Authority— Promote Decentralization. 4. Hackers should be 
judged by their hacking, not bogus criteria such as degrees, âge, race, or position. 5. You can create art 
and beauty on a computer. 6. Computers can change your life for the better.” See Logik Bomb, 
Hacker’s Encyclopedia, Second Revised Edition, 1997. 

202 Directive 95/46/EC, Preamble (3). 


184 



computer techniques. Through success in surrendering to information Systems, they supersede 
others in hacking techniques and skills, even though they hâve an apparent inability that leave 
them incompetent with others in social activities generally. Yan and Zhang (Beijing Youth 
Daily, 6 November 2001) hâve reported the case where a 17-year-old hacker intruded into an 
official human-resources web site, defaced the homepage, formatted the hard disk of the 
server, and destroyed a great deal of data. It was reported that during his sick leave at home, 
the hacker had picked up his hacking knowledge from the hackers’ web sites, and 
downloaded some hacking programmes. Then he found some web sites with security holes 
and intruded into them. At fïrst, he sent messages to the administrators of these web sites, 
telling them that their web sites had loopholes. Without receiving any reply, he got angry and 
defaced some of these web sites (Yan and Zhang 2001). 

(iii) Challenging technical difficulties 

Technical challenge has been long identffied as a motivation. Pipkin (1997) regarded 
challenge as the biggest motivation, meaning that the hacker is excited after succeeding in his 
attack on most secure Systems. In one case, a hacker created a Trojan programme named 
IPXSRV, and gained control of 60,000 computers. He manoeuvred this colossal “botnet” 203 
to launch déniai of service attack against a music web site for three months before the police 
detected it. Investigation revealed that the hacker had been seeking a chance to try the power 
of his Trojan programme, and chose this web site as a target of déniai of service attack. As a 
resuit, the web site was broken down for three months (Secretchina 17 March 2005). 

(iv) Seeking knowledge 

Cybercrime motivated by a desire to seek knowledge is not rare in practice. Jordan (1998) 
reported the motivation of Kevin Mitnick, the most famous of ail hackers was to gain 
knowledge, seeking a better understanding of infonnation Systems. 

Many computer and Internet users are motivated to acquire knowledge from the devices, 
information and new space. Both hardware and software are the targets of their 
knowledge-seeking attempts. Hackers are seeking knowledge through access to others’ 
computers by fair means or foui. “The Hacker Manifesto” clearly expressed the motivation 

203 Botnet is “a collection of compromised computers controlled by the same intruder, often [using] 
remote control software or Internet Relay Chat (IRC) services.” Daintith (2004), p. 56. 
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behind hackers of this kind. It stated that cyberspace was a world of “the électron and the 
switch,” and hackers were called criminals due to their use of the services without paying 
during their seeking after knowledge motivated by curiosity. 204 

(v) Testing System security and resilience 

Technical primacy is one of the most important answers to the question “what do 
hackers hack for?” The coinmon sense knowledge about the attacks is that hackers identify 
flaws in Systems or software, to allow the developers or the administrators to fix them (See 
Branscomb 1990, p. 24). For example, Brian West used MS Front Page and a web browser to 
identify a security flaw in some web sites that allowed him to hâve access to proprietary 
information and password files (See U. S. Department of Justice, Press Release, 24 
September 2001). Hacking for security may be quite the same to hacking for insecurity: on 
the one hand, the unauthorized intrusions into the protected Systems are illégal; on the other 
hand, the publication of security flaws also poses a real danger for the Systems. 

In addition, some physical damage to information Systems is also possible when testing 
the resilience of factors under operating conditions. For example, in R. v. Feltis, 205 one of the 
explanations of the accused about why he had apparently sabotaged the company's computer 
was that he had been testing the computer, and particularly its resilience to interférence, by 
disconnecting two cables and reconnecting them, as a resuit of which an impairment of the 
computer was caused and an enormous disruption of the business of the company occurred. 

(vi) Adventuring risky online activities 

Traditional adventurers hâve sought psychic satisfaction from conquering things others 
hâve seemed unable to do, and during which they overcame unimaginable difficulties. The 
modem adventurers hâve also found challenges in the field of technology, from 
télécommunications, computers to the networks. The ability to influence huge Systems may 
be satisfying in and of itself. 206 Activities, either benign or malicious, on the “electronic 

204 The Mentor, The Hacker Manifesto, 8 January 1986. 

205 [1996] EWCACrim 776 (19thAugust, 1996). 

206 See Ministry of Justice (1985), p. 206; Howerton (1985), p. 54; the United Nations Crime and 
Justice Information Network (1999), Paragraph 74; Schwartau (1994); Branscomb (1990), p. 24; 
Grabosky (2000). Creator of Melissa Computer Virus said that he constructed the virus to évadé 
anti-virus software and to infect computers using the Windows 95, Windows 98 and Windows NT 
operating Systems and the Microsoft Word 97 and Word 2000 word processing programmes. See 
United States v. Smith (D. NJ) 2 May 2002. 
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frontier” involve the factor of adventure, that is to say, to explore the unknown (Grabosky 
2000, pp. 2-3). What Donn B. Parker called the personification of computers (Parker 1998) is 
also such a motive. Sophisticated viruses indicate that writers who believe that their works 
contribute to the development of science and technology hâve created them (Kabay 2001). 

Adventure is closely associated with the conception of curiosity. Under the drive of 
curiosity, considérable examples of such curious intrusions hâve happened, which had 
catastrophic effects (Howerton 1985, p. 54). 

Adventure is not always a simple motive that can be explicitly identified. Sometimes, it 
is closely related to other motives, and in other cases, the adventure motive may be 
ambiguous. According to The Associate Press (19 March 1998), when the hacker, who called 
himself “The Analyser”, and launched an attack against the Pentagon's computer Systems, 
was identified by the U. S. Department of Justice and questioned by a spécial police 
anti-hacker unit, the chief administrator of the country from where the 18-year-old boy came 
praised him: “Damn good, very dangerous, too.” 207 Soon after the incident, the hacker was 
drafted into the national army to serve in an information warfare division, an assignment 
which utilized his computer talents. 208 

(vii) Trying programming skills 

In contrast to testing hackers who try to identify flaws in computer Systems, 
experimental hackers try to reveal the functions of hacking programmes. Whether the 
Systems are secure or not is irrelevant. Actual intrusion into the Systems is only an occasional 
resuit. Many Internet users did experiments of this kind with software downloaded from the 
Internet, or programmes compiled by them, and sometimes no actual intrusion succeeded. 
Relatively unprepared and unintended, experimental hackers are usually the “first offender”. 
Their purpose is to test the function of intrusion programmes or techniques, during which 
they accidentally succeed in acquiring unauthorized access to the Systems. 

(viii) Tentative attacks 

Tentative hackers are similar to experimental hackers in the way that they are unprepared 
intentional intruders. Nevertheless, a distinctive point is that tentative hackers try to use 

207 Pentagon hacker Wins Praise, Associated Press, 19 March 1998. 

208 Israeli Teen Hacker Details Prowess, Associated Press, April 1998. 
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hacking programmes or intrusion techniques. Whether the System is secure and whether the 
intrusion is successful are both irrelevant considérations. For example, some users operate 
password-cracking programmes to access others’ encrypted infonnation. Internet users 
sometimes also try to guess other users’ account ID and passwords so as to enter their 
Systems. 

(ix) Expression of hatred 

Hatred may corne into being for a variety of reasons. Dissatisfied employées damage 
their employers’ assets. Dissidents are motivated to destroy the States’ critical infrastructure. 
The hacktivists, anarchists, and terrorists ail launch attacks against targets regardless of their 
nature. Generally, hatred leads to attempt to weaken the counterparts’ social priorities. 
Examples include ruining computer Systems; 209 destroying infonnation (Howerton 1985, p. 
55); revealing confidential data (Grabosky 2000, pp. 2-3); and defacing abhorrent web pages 
(Grabosky 2000, pp. 2.-3). 

Envy may also lead to hatred. In cybercrime, attackers commit sabotage due to envy of 
others’ wealth, competitors’ success, and colleagues’ achievements. 

(x) Hacking for financial gains or avoiding payment 

Not only has information itself value, but information Systems are also used widely in 
the financial sector (Parker 1998). Because the function of the computer in accounting 
enables a wide use of computers in financial management, embezzlement has been made 
easier by numerous methods (Howerton 1985, p. 54). These methods may include 
information selling without the right to do so; extorting from the victimized organization; 
embezzling from employers; illegally obtaining information to sell to competitors; electronic 
theft of credit-card numbers; and stealing personal infonnation to impersonate someone 
financially (Ministry of Justice 1985, p. 206). 

The perpetrators steal, swindle, embezzle, and blackmail property in order to maintain a 
livelihood, seeking ease and comfort, repaying gambling debts (Parker 1998), or avoid 

209 For example, in prosecuted cases such as United States v. Garcia (C. D. Cal.) 23 February 2004; 
United States v. Diaz (S. D. Fia.) 5 December 2003; United States v. Patterson (W. D. Pa.) 2 December 
2003; United State v. Lloyd (D. JN) 26 February 2002; United States v. Ventimiglia (M. D. FL) 20 
March 2001; United States v. Sullivan (W. D. NC) 13 April 2001; United States v. McKenna (D. NH) 
18 June 2001. 
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payment. In Morgans v. Director of Public Prosecutions, 210 the accused used the téléphoné 
line to acquire unauthorized access to the computer Systems of several different companies, 
thus obtaining télécommunication services without payment. In the face of deliberate 
financial hackers, even the most secure Systems on the Internet are meeting universal threats. 

In fact, financial hacking is not always as sophisticated as imagined by the public, for 
sometimes hackers may be the software provider. This is a serious threat for the banking 
System. 

(xi) Hacking for educational reasons 

This kind of hacking is the unauthorized use of the Systems for educational purposes. In 
the early stage when computer hardware, software, and network services were expensive, they 
could only be obtained by a limited number of big organizations and universities. Many 
hackers tried to use the System for educational purposes without pennission. Nevertheless, 
with the development of less-bulky, low-cost personal computers, this kind of educational 
hacking has become history. 

(xii) Changing academie results 

University students hack for better scores or grades in academie records. In August 1977, 
officiais at a large university in the U. S. uncovered a scheme involving payments by students 
who wanted their grades altered in the school’s computer centre. Investigators found that 
several thousand dollars had been paid to a university employée who made changes on grade 
cards that were later used to make entries in the university’s computer. 211 From then on, 
dozens of students in the U. S. hâve been caught hacking into school computers to give 
themselves better grades. In one case, nineteen students were suspended after being accused 
of knowingly involved in electronically changing their transcripts. Seven other students were 
told their grades were altered. Nevertheless, this was apparently done without their 
knowledge. 212 


21U [2000] UKHL 9; [2000] 2 Ail ER 522; [2000] 2 WLR 386; [2000] Crim LR 576 (17th February, 
2000). The conviction was overruled due to the matter of obtaining the evidence, which was obtained 
through the installation of an interception device into the téléphoné line of the accused. 

211 Lehigh University Uncovers Payment to Alter Grade of Student, New York Times, 1 September, 
1977, A-18. 

212 C. Anderson, Hacking the Grade, Originally Aired, 3 September 2002. Retrieved 15 March 2007, 
from http://www.techtv.eom/cybercrime/internetfraud/story/0, 23008,3396685, 00.html 
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(xiii) Harassment and murder 

Internet harassment can occur in nearly every Internet service to direct obscenities toward 
others, and make insulting statements based on gender, race, religion, nationality, or sexual 
orientation (Kelly 2002). In offences where information Systems are used as means of 
committing verbal assault, threat, harassment, alarming, spam and fraud, the motivation of the 
perpetrator is to harass and to kill the victim. The function of the Internet as a means of 
communications and with a high anonymity of interaction often entraps the victims into 
unforeseeable dangers. In 2005, China Ministry of Public Security investigated 1,000 
assassination cases, in many of which the criminals found the potential victims through the 
Internet (Yi 2006). In many criminal cases, stalkers and murderers find and entice victims 
through the communication and interaction of various Internet services. 

(xiv) Launching political movement 

For many years, defence forces, governments, and even computer companies hâve been 
popular targets for sabotage attacks. According to Daler and co-workers (1982), political 
groups in France repeatedly damaged computers, asserting that computers were the favoured 
tools of those who dominate. Italy, the former West Gennany, the U. S., the U. K., Japan, and 
the Scandinavian countries hâve experienced sabotage as well, with both the old- and 
new-fashioned attacks on malicious programmes (Daler and co-workers 1982, pp. 24-25). 

Political hacking also formed an extreme movement: “hacktivism”. Hacktivists launch 
politically motivated attacks on public web pages or e-mail servers (Vatis 2000). In 1999, for 
example, the homepages for the White House was attacked by political activists protesting 
against the site’s politics. 213 

(xv) Launching cyber warfare 

People worry that the threat of cyberwarfare will be a future nightmare because hacking 
communities hâve the ability to launch destructive attacks on computer Systems. In recent 
years, a cyberwar was nearly taking place. In 1990, a hacker organization “Légion of the 
Underground” declared war on some countries in retaliation for human-rights violations. 
Several other hacker groups condemned the aggressive act, and soon after, the Légion of the 


:L ' See U. S. Department of Justice, Congressional Testimony on Cybercrime Strategy, 28 July 2000. 
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Underground retracted their déclaration of cyber war. 214 Cyberwafare also happened in the 
initial years of the twenty-first century. Hacker groups became popular in East Asian 
countries during several cyber wars, mostly between hacker groups of different countries due 
to their positional différences on some international affaire. At that time, the relevant 
countries were highly vigilant to potential abuse of computers and networks and invested 
more heavily on information security control. 

(xvi) Carrying out anti-computer actions 

As some people are against mechanicalization, electronization, industrialization, 
modemization, and globalization, others are against the process of computerization, 
informationization and networking. According to Parker (1998), some hacker sympathizers 
describe attacks as justifiable protests or direct action against enemies of the environment or 
of society in general. 

Unabomber represented another kind of anti-computer “hacking”. He carried out 16 
bombings, which, altogether, killed three and injured 23 people. 215 His “Unabomber 
Manifesto” claimed that technological progress brought about undesirable requirements for 
the people, and that the people could stop this situation so as to recover their happier and 
simpler life close to nature (See Kaczynski 1996). Some other activists ail over the world also 
destroyed a number of computers to protest against a computer society in which they thought 
that computers were being used to control people. 216 Indeed, they were not hackers in 
cyberspace, but traditional style bombers in real society. 

(xvii) Mimicking cyber Robin Hoods 

Orthodox hackers hack in order to make programmes or information available to others 
free. As a hacker, Maelstrom, stated in an interview that he had never any feeling of moral 
apprehensiveness when he made Internet access accounts available to the public for free 
through hacking (Jordan and Taylor 1998, pp. 768-769). 


214 For the story, see Palczewski (2001). For the joint statement, see 2600 and co-workers. Joint 
Statement Condemning LoU Cyberwar, 2600 News, 7 January 1999. Retrieved 15 March 2007, from 
http://www.2600.com/news/view/article/361 

215 The offences were carried out during 1978 and 1995. As of 2004, Kaczynski was serving a life 
sentence without the possibility of parole in a maximum-security prison in Florence, Colorado. 

216 The French activist group called CLODO (Comité de Libération ou de Détournement des 
Ordinateurs), committed the offence between 1979 and 1983. 
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Whether some charitable concems or individuals will also crowd online to hack for 
money is an unanswered question. A hacker initially wanted to test how the security level of 
the mobile communications networks. After he found that he could make money through 
selling the cards with revised passwords, he opened a spécifie bank account in which to 
deposit the money, a separate account from his own daily-used bank account. He said that he 
did not hack for himself, but for the wellbeing of others. He donated 200 Renminbi Yuan 
(about 20 euros) to a leukaemia patient (Gao 2006). 

Cyber Robin Hoods do not always publicize their intent. But on some web sites, methods 
for counterfeiting money are published. 

(xviii) Practising unfair compétition 

In order to enhance compétitive capacity, businesses also engage in attacks against 
compétitive rivais. In the 1990s, when the Internet economy boomed, many big online 
enterprises secretly attacked the web sites or defame the réputation with each other. Attackers 
benefit from the décliné of competitors and from the increase in their own market share. They 
even practice access to each other’s computer Systems to obtain business secrets. In the rapid 
development of the infonnation market, such destructive or espionage activities are fatal to 
the victimized enterprises. 

(xix) Practising trap marketing 

Some anti-virus compilers plant computer viruses and other destructive programmes into 
their anti-virus software to force users to purchase the upgraded versions of anti-virus 
software they compile or sell. By doing so, they hope to increase the market share and sale of 
their own products (Jiang and Yu 1997, pp. 18-27). Web sites owners also frequently use this 
trap marketing. Cookies are an example that is widely known and accepted. In malicious 
marketing cases, some web sites infect users’ computers with embedded harmful codes and 
instruct the users of infected computers to visit their web sites repeatedly and to pay for 
cleaning the computer. Other fonns of entrapment also include kidnapping computers or 
programmes in order to render the machine repeatedly operating in a way benefiting code 
writers or spreaders. Web browser manipulation is one such abduction that Controls the 
homepage, or even the whole browser, and is directed solely to the perpetrators’ web sites. 

(xx) Strengthening self-defence 
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Hacking has also been used for self-defence. For example, in order to prevent illégal 
réplication of software, a pair of Pakistani bothers bundled “Brain Virus” into their software 
and attacked Delaware University in October 1987 (Forester and Morrison 1994, p. 93). Their 
idea was that only those who pirated the software would be victimized, the virus being an 
automatic rétributive tool. The followers of a religious cuit in an Asian country also attacked 
the satellite communications Systems as a means of self-defence. The govemment charged the 
religion with being an “evil cuit” and prohibited its practice. In revenge, members of this 
forbidden religion used the Internet to hack several times into the satellite broadcasting 
System, and changed the official TV programmes to video programmes disseminating the 
“truth” about this religion. 

The idea of the above-mentioned “Pakistan virus” is not without descendants. Many trial 
versions of software (or shareware) include similar idea in expressive fonn. While some of 
the trial versions can work in one way or another after the trial period, other trial versions can 
be completely disabled. For example, a certain kind of operating System provides a 30-day 
trial period, after which the System cannot be operated without registration, which implies a 
process of purchasing. Without the operating System, the computer is simply broken down 
—analogous to an attack launched by a logic bomb, except that it is an “attack” under the 
cover of failure to register after the trial period. 

(xxi) Hacking for récréation 

Both récréation and hacking are exciting. Randall and co-workers (2000) found that 
excitement was a major reason for hacking. Here, hacking has an équivalent function to 
entertainment. Although computing is different from gaming, the computer has a close 
relationship with gaming. Not only are computer and online games prévalent, but the use of 
the computer and the surfing of the Internet may serve gaming instinct. Many users enjoy 
online surfing, interaction and self-publishing, but fewer expérience success in accessing and 
controlling others’ infonnation. But by overcoming the slight difficulty in cracking users’ 
password or other access-control measure, a unique pleasure is afforded to users who 
expérience this victory. 

(xxii) Employment-related hacking 
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Although considérable hacker activities are in fact illégal, the successful hacker will 
usually be admired for his or her skills. At the same time, many hackers hâve been offered a 
well-paid job as a computer expert or even security manager. For example, Robert T. Morris, 
was one such. He created the Morris Worm in 1988, infecting about 6,000 computers and 
causing losses that ranged from 200 to 53,000 dollars each. At présent, on his web site, he 
writes that: “I’m at the MIT Computer Science and Artificial Intelligence Laboratory...” 217 

Banks (1997) related hacking to employment, which means that if the hacked System 
owners caught the hacker, they would employ the hacker exactly to protect the Systems from 
other intruders. 

A high-profile employer can employ a hacker who has damaged thousands of computers 
and caused losses of millions of dollars, a natural analogy is that a better chance of 
employment should be hacked together through millions of computers, and billions of dollars 
of losses. Altematively, less skilful hackers might try to damage some hundreds of computers 
and obtain an ordinary job offer. Criminal hackers are usually better off after their hacking 
activities hâve been made public. 

By saying this, we are not making complaint about a function of the judicial System that 
allows the réhabilitation of those who hâve committed offences in this way. In contrast to the 
idéal “general deterrence,” the question arises as to whether such a practice serves a 
generally-motivating rôle. 

Employment-related hacking is not limited to getting employment opportunities through 
hacking. Hackers hâve sometimes hacked as a fonn of rétribution when an employer has not 
provided an offer. Skeeve Stevens seriously damaged the AUSNET, an Internet company that 
refused to employ him. He had compromised 1,225 crédit cards and displayed a message on 
the company's homepage in April 1995, saying, “AUSNET is a disgusting network ... and 
should be shut down and sued by ail their users!”' In addition, in DPP v. Lennon,' after 
being dismissed, the accused had downloaded a mail-bombing programme from the Internet 
and used it to automatically send about 5 million e-mails to the former employer’s e-mail 


217 Retrieved 15 Mardi 2007, from http://pdos.csail.mit.edu/~rtm/ 

21s Phrack Magazine, volume 8, number 53, 8 July 1998, article 14 of 15, OXd. 

219 Director of Public Prosecutions v Lennon [2006] EWHC 1201 (Admin) (11 May 2006). 


194 



servers. His purpose was to bring in the company into a “mess” and did not think his action 
was criminal. 

(xxiii) Hacking for the hacker community 

For those who regard themselves as hackers, “hacker” is a Symbol, a label, a banner, a 
movement, a front, and a centripetal force, regardless of the fact that each hacker, particularly 
each of the malicious hackers behaves in a pattern that is not necessarily the same. Therefore, 
the hacker community is in reality a symbolic clan in which members “hack” in variant ways 
and for different ends. 

Regardless of the fact that the members of the hacker community are heterogeneous, 
cases where hackers hâve united to take actions against legal or administrative measures 
targeted at certain “members” of their “hacker community” are not rare. The mere name of 
“hacker” may serve to raise an emotive force capable of bringing ail kinds of hackers together, 
including traditional hackers, and hackers who are regarded as cybercriminals. In fact, in such 
a case, their activities are unreasoning: on the one hand, the activists do not belong to a single 
group; on the other hand, their targets are far firom being only the web sites of the 
law-enforcement agencies. Their good will is to maintain the image of a “hacker community” 
as a whole, to prove their power against traditional govemment and law enforcement, and to 
resist an outside invasion. 

Sub-culture was a term First used by A. K. Cohen in Delinquent Boys: the Culture of the 
Gang (1955) to dénoté a group or groups inside the host culture with different values froni it, 
as evinced through their expression in déviant behaviour (Walsh 1983, p. 214). Zheng (2004) 
attribute this motive to impact of the internai communications of the cybercriminal 
sub-cultural group. As to the situation in traditional criminal sub-cultural groups, these 
communications produce cohérence inside the group. However, the network exists as a means 
of communications and enhances the communicative pattern of cybercrime. Intrusion 
techniques and skills are the just contact-nodes for their members. 

(xxiv) Destroying evidence contained in information Systems 

Information Systems usually contain evidence for various kinds of cases, civil, criminal or 
administrative. The party for whom the evidence is unfavourable has a motive to destroy it, 
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before or during the search and seizure by law-enforcement agencies. In R. v. Anitta 
Debnath, 220 after the police began to investigate her harassment of the victim, the perpetrator 
paid a group of computer hackers to assist her to hijack the victim’s e-mail, in order that the 
victim could no longer access the account. 

(xxv) Sexually motivated misuse of infonnation Systems 

Sex crimes cover a broad category of déviance. The most frequently prosecuted forms of 
sexually motivated misuse of information Systems are the recording, depositing, transmitting, 
and trading of child pornography; 221 sexual harassment through communication by using 
information Systems; and promotion of (illégal) prostitution with the assistance of infonnation 
Systems. 

(xxvi) Child abuse 

Children are vulnérable group of people in society. Although international consensus has 
been achieved and treaties hâve been implemented requiring govemments to “take ail 
appropriate.. .measures to protect the child from ail fonns of physical or mental violence, 
injury or abuse, neglect or négligent treatment, maltreatment or exploitation, including sexual 
abuse...,” 222 incidents, in which children are abused frequently happen. The abusers are 
increasingly using infonnation Systems to lure children to engage in sexual activity and 
spread child pornography. For example, in R. v. Kasam, 223 the accused used his computer to 
collect hundreds of images and several video clips of child pornography (paragraph 2.5). In 
one compact dise were found 3,200 images of child pornography downloaded from the 
Internet (paragraph 2.4). 224 Besides sexual motives, there may also be présent violent abuse 


22U [2005] EWCA Crim 3472, No. 200501008A7. 

221 See for example, United States v. Ziegler (No. 05-30177 D. C. No. CR-03-00008-RFC ORDER 
AND OPINION, 6 March 2007), in which the perpetrator used the company’s computer to view, 
deposit and exchange child pornography. 

222 UN Convention on the Rights of the Child (adopted and opened for signature, ratification and 
accession by General Assembly resolution 44/25 of 20 November 1989, entry into force 2 September 
1990), Article 19. 

223 2004 ONCJ 136 (CanLII), Docket: 10018867. 

224 The court listed some of the depicted graphie scenes that are identified as child abuse: 

“ (a) A 6-month-old baby girl with an adult male pénis having ejaculated onto the vaginal area of the 
child; 

(b) A blind-folded 4-year-old girl performing fellatio on an adult male pénis; 

(c) An adult male performing anal intercourse on a 7-year-old girl; 

(d) A 5-year-old girl performing fellatio on an adult male; 

(e) An adult hand is fondling a 7 to 8 year-old girl who is handcuffed. Several adult fingers are 
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of the child. These two aspects are closely connected with each other. In R. v. Sharpe, the 
court held that “the possession of child pornography and associated harms to children is the 
use of child pornography by paedophiles to groom children into committing sexual acts” 
(paragraph 205). 

(xxvii) Anti-deviance hacking 

In both cases of United States v. Jarretf and United States v. Steiger," hackers 
reported the cases and provided critical evidence for the law-enforcement agencies. They hâve 
never appeared before the court or been prosecuted. In other cases, such hackers were sued. In 
a civil case, Fischer v. Mt. Olive Lutheran Church, 227 other employées in the Church 
suspected Fischer, a Lutheran minister, of engaging in sexual misconduct. They hired a 
computer expert to guess the password of the Hotmail account that the minister was known to 
use frequently. As a resuit, they cracked the password, looked through and printed the 
minister’s messages, in some of which were included contents about sexual activity between 
the minister and other men. 228 

(xxviii) Comprehensive motives 

In some other cases, the offenders hâve multiple motives, interrelated or unrelated with 
each other. For example, in R. v. Geller, 229 the offender possessed 101 pornographie images, 
chatted with young girls of 13 or 14 years old in order to establish relationships (paragraph 5), 
obtained 400 crédit cards and other personal information through hacking, accessed the 
Internet for 28 times without paying (paragraph 6), and engaged in activities that lead 
information Systems to malfunction (paragraph 7). 

(xxix) Unclear motive 


inserted into her vagina and her rectum is penetrated with a long stick; 

(f) An 8-year-old girl is at a pinball machine. During the 6 minute video she is fondled by an adult 
female who undresses the young girl, fondles her and ultimately the adult female performs cunnilingus 
on the young girl on the pinball machine; 

(g) The same adult female takes the same 8-yar-old girl in the pinball video in another video and the 
young girl is guided by the adult female to perform fellatio on an adult male. The video is entitled 
R@ygold_the family; 

(h) Another video entitled family 10.jpg depicts a 6-year-old girl who is naked sitting on a toilet 
performing fellatio on an adult male.” See ibid., paragraph 2.6. 

Fourth Circuit No. 02-4953, 3 June 2003. 

Eleventh Circuit No. 01-15788, 01-16100 and 01-16269, 14 January 2003. 

Western District of Wisconsin No. 01-C-0158-C, 28 March 2002. 
ibid. 

2003 CanLII 31190 (ON S.C.), Docket: 493. 
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While many perpetrators act in a way to achieve something or destroy something, others 
act without reasonable reasons. In sonie cases, it is impossible to detect an impressive motive 
from the facts of the offence: the révélation of the abuse of information Systems cannot lead to 
a clue for a useful identification of the State of mind. In State v. Moning, the accused used the 
computer terminal to obtain access to the database to run a query on the previous drug 
conviction of his acquaintance. After he printed a copy of the infonnation, he handed the 
victim the printout. At this point, the victim became aware of the perpetrator’s behaviour and 
reported his unauthorized access. 230 

(xxx) (Not motivated but) influenced by psychological dépréssion 

In R. v. Taylor, 231 the accused woman illegally accessed the account of a man through 
computer Systems and issued an unauthorized passbook for the account, with which an 
unidentified man attempted to withdraw £25,000, succeeded in getting £500 in cash but failed 
to get £24,500 in chèques. The opinion of the doctors showed that the woman was diagnosed 
as HIV positive during her committing the offence and was in a State of "clinical dépréssion" 
which affected her judgment about her behaviour and the likely resuit of her behaviour. 

Curiosity is an irrésistible mental power, propelling people to know the unknown and to 
control the uncontrollable, or to destruct the constructed, and to deorganize the organized, 
whether in the macro or the micro dimensions. Infonnation Systems are a dimension which 
has developed partly under the dynamics of human curiosity and has been threatened partly 
by this force. 

Apart from the abundant findings identifying motives in this study, I found that for many 
hackers, instead of hacking for something, they hâve succeeded in hacking and then found 
something to obtain or destruct. The initial hacking was merely a random activity that 
accidentally succeeded in furthering additional actions. Successful hacking, it could be 
imagined, might lead to any kind of sabotage, destruction or vandalism, the obtaining of 
confîdential or proprietary infonnation, acquiring control over a System, and so on. Therefore, 
we can safely conclude that there are hackers who hack out of spécifie motives, and that there 
are also hackers who firstly hack and then find opportunities to reach spécifie goals. For 

230 2002-0hio-5097. 

231 [1998] EWCACrim 1545 (12thMay, 1998). 
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hackers with spécifie purposes, the hacking process may be a sophisticated endeavour before 
they take hold of the compromised System, because they hâve to conquer the unknown 
continent of security. For hackers with less clear initial purposes without wanting to obtain 
something spécifie or destroy something spécifie, the hacking process may be more 
straightforward until the System is exploited, because they only harvest from a conquered land. 
These different hacking models imply that the goals can emerge before the beginning of the 
initial hacking or after the success of the initial hacking—in the latter case, the attempted 
hackers are likely to defend themselves by expressing the benign motive of wanting to face a 
technological challenge or a security loophole rather than by stating a malicious intent of 
économie espionage or sabotage. In this latter case, the motivation is that of a challenging 
adventure into the partially unknown. 

6.8 Conclusion 

Infonnation Systems store rich and colourful resources, attracting digital community 
constructors, conquerors, conspirators and criminals. With one-sixth of the population 
connected online, with a prolonged online time, and diversified online activities, it is natural 
that cybercriminals constitute a greater ratio among the Internet users, and that cybercrimes 
will constitute a greater proportion of the whole crimes. If the unbalanced démographie 
distribution of computer and Internet users exists within different âge groups, the comparison 
of their online behaviour is a valuable indicator in finding the reasons for this. The key 
concern in this comparison is that of the rôle of juvéniles and young adults. Empirical studies 
hâve disclosed that youths may hâve more chances to use computers and the Internet and are 
more likely to commit cybercrime and be victimized. The natural and social properties of 
different âge groups hâve been shaped in different ways. Different hâve been their 
educational background, financial status, sense of responsibility, family structure, social 
interactions and interconnections, self-control, psychological make-up, and interest, 
knowledge, and skills. These distinctive characteristics detennine that they are confronted 
with different chances and challenges in information Systems, and in respect of gaining and 
losses in the online activities. As a resuit, young people are more likely to be involved in 
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online adventures, stalking or stalked, exploiting or exploited, hacking or hacked. 

The internai reasons why criminals are devoted to cybercrime are connected with the 
functioning of information Systems. This shows that the novelty and mobility of information 
Systems enable people from quite different contexts to find something useful, valuable and 
profitable. Psychological satisfaction, spiritual enjoyment, financial obtaining, winning famé, 
opportunity getting, and fortune seeking are ail realizable through the use and misuse of 
information Systems. The motivations of committing cybercrimes are diversified. This means 
that cybercrimes are profitable for whatever purposes the criminals are pursuing. 

To sum up, the criminals’ motives may be satisfied in part by her or his having 
committed a crime against the person and in part by his having committed a crime against 
property. And there may be motives that can be satisfied outside both these opportunities. 
Motives of likely offenders are different but barely novel (Grabosky 2000, pp. 2-3). 
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CHAPTER 7. CRITICAL FACTORS IN COMBATING CYBERCRIME 


7.1 Introduction 

Information Systems hâve multiple vulnerabilities (Chapter 3), plays multiple rôles in 
cybercrime (Chapter 4), while the cybercriminals are themselves hâve varied motivations 
(Chapter 6). This chapter will discuss critical factors in the fîght against such offences. The 
core question I seek to answer the question of the ease ordinarily in finding cybercrime. By 
saying “find”, I cover a wide range of activities leading to punishment: détection, reporting, 
investigation, prosecution, proving and conviction. 

At présent, the fight against cybercrime also nécessitâtes better knowledge about the 
critical factors. For several décades, many commentators hâve written about the 
characteristics of cybercrime, and many aspects hâve been generalized in the light of the 
surveys, observation and thinking (Thompson 1989; Sieber 1998, etc.). 

The following chapter is designed to make a synchronie inquiry into the characteristics of 
cybercrime in comparison with traditional offences. 


7.2 The victims of cybercrime 

The perpetrator-victim relationship in cybercrime is developed through infonnation 
Systems in a process of human-machine-human interaction. The perpetrator fulfils the first 
half of the interaction and the victim is imposed into the second half of the interaction. That is 
to say, the victimization of victims of cybercrime also relates to information Systems. Victims 
are also users whose information is deposited in or published through information Systems, 
whose daily life or operation dépends on the Systems, or whose welfare is increased through 
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the Systems. Like cybercriminals, they are also distributed over an unlimited area. 232 In 
addition, in cases such as virus attacks, multiple victims can be involved. Thousands or 
millions of users are also likely to be victimized in one case even. Individual users usually 
hâve a lower awareness of cybersecurity than corporate users, and invest less money and time 
in maintaining and protecting the Systems and less on updating their anti-virus software. 
Although individual users are more vulnérable to potential threats, their losses are usually 
neglected and underreported. 

Computer networks are not so new, but the pervasive use of them is a recent 
development. The current génération of people accepts, and dépends more on, information 
Systems than previous générations. There exists a clear-cut information génération within the 
information society. Because more young people use the Internet than the elderly do, it is 
natural that these youths are more likely to be victimized in cybercrime. Thus to some extent 
cybercrimes are offences of youths against youths. We do not find a sharp réduction of 
computer use with the increase in the âge of young users. Therefore, it is to be expected that 
with the increase in âge of the Internet users, more victims will also be found in future among 
older users. 

Simultaneously, it is undeniable that with more and more organizations pursuing online 
businesses and other activities, the likelihood that these organizations will be victimized will 
also grow. In fact, the victims of the original offences against information and infonnation 
Systems were mainly organizations. In the future, they will still be vulnérable to inside and 
outside attacks. One advantage these organizations hâve for protecting their information and 
information Systems is that they hâve a greater capacity than the individual users to afford the 
anti-virus, firewalls, other access-control mechanisms and for updating these mechanisms. 


For example, in United States v. Magnuson (Fourth Circuit No. 964957, D. C. No. CR-96-186-A, 
24 June 1997), the accused used his home computer to attack one victim’s computer servers in seven 
States. Apart from unauthorized access to information Systems, other crimes committed with the 
intervention of information Systems can also involve globally distributed victims. For example, in 
Bohning v Government of the United States of America [2005] EWHC 2613, the accused exploited 
the télécommunications Systems to contact young girls and arrange sexual relations with them. The 
police revealed from his laptop computer thousands of images of child and baby pornography. The 
e-mail and chat messages proved that he had transmitted pornographie material to young girls over the 
world and incited them to engage in sexual relations with him (paragraphs 2 and 3). 
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It is a trickier question when the online victims are more likely to be victimized in a 
“voluntary” or “active” manner. For example, the Nigérian 419 fraud victims may transfer a 
sum of money voluntarily to the perpetrators; victims of date râpe may go to meet the 
potential criminals voluntarily; or users may voluntarily retrieve web pages that contain 
malicious codes, and so forth. Victims are also more likely to admit their “willingness” or 
“activeness” and less inclined to report the case. 

Actual victimization in cybercrime can be more complex through the extension of 
victimization. For example, the senders of e-mail messages hâve adopted clever tricks in 
soliciting récipients. Opening the messages and the attachments is the flrst goal of the senders. 
Generally, they use ambiguous and false sender and subject columns, but ensure that there are 
valid contents (except messages spreading viruses) to show their offers and set their traps. 

Unsolicited e-mail messages can hâve a broader influence on criminal phenomena, 
where the question is not only of victimization, but also one of conspiracy. Not only do e-mail 
communications become an offensive means by which the récipients are victimized, but these 
victims then serve as part of a conspiracy, for they are seduced to participate criminal 
operations. 

In the Internet environment, the most frequent victimization model begins firom an 
exposing of victims to potential threats, which we can call the exposing-victimization model. 
With this model, the victim of unsolicited messages merely puts his/her e-mail address on the 
web pages, bulletin-board Systems, uses it in the chat Systems, or even simply transmits it 
through the Internet. The exposure is not necessarily a show-off. Rather, it is just a kind of 
presence on the Internet literally or digitally, something inévitable. Nevertheless, the 
exposing-victimization model at least implies that the senders of unsolicited messages could 
easily get the e-mail address in the same way as other Internet users do, without further efforts 
in collecting or harvesting these addresses. 

In other cases, the senders of messages hâve a search process, and follow the 
searching-victimization model. Due to the large quantity of web pages and other 
Internet-related contents, the direct artificial collection of multiple e-mail addresses becomes 
inefficient. The senders (here we also imply address providers) utilize specialized software to 
harvest e-mail addresses from the Internet. This collecting process becomes automatic and 
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efficient. The perpetrators hâve created the searching-victimization model in sending 
messages. Besides harvesting, they also use a dictionary attack and/or an automatic 

alphabetical permutation and combination to enumerate possible usernames in e-mail 
accounts. These methods can also be categorized into a searching process. For the senders, an 
e-mail account with a random word might not represent a specified person; but for the 
récipient, he/she is readily the victim of this unsolicited message with attachment. 

The victimization of récipients of unsolicited messages happens without the appearance 
of the récipients in their e-mail account. The victimization means that their e-mail accounts 
are being spammed, whether they open their accounts or not. Under current the legal 
framework, the receiving of unsolicited messages is sufficient to constitute a victimization of 
the behaviour to be imposed punishment. 

However, the victimization of unsolicited messages does not end at the initial 

victimization. The above-mentioned models could be called the first-level effects of 

unsolicited messages. Subsequently, the second-level effects are based on the initial 

victimization. There are possibly also two submodels: initial victimization-subsequent 
victimization model and initial victimization-conspiracy model. 

The initial victimization-subsequent victimization model happens when the messages 
include viruses, fraudulent sales of goods, or falsified financing and banking services. The 
first-level victimization is being spammed, while the second-level victimization is being 
attacked or swindled. 

Second-level victimization is not always fulfilled so simply. There is usually involved an 
initial victimization-exposing-searching-subsequent victimization process. In the case of the 
Nigérian 419 fraud, the récipients of the unsolicited messages were firstly victimized by 
receiving messages of this kind (being spammed). If they took a positive reaction to the 
messages, they were further exposing themselves to the senders. Upon receiving the 
récipients’ response, the senders further worked on the vulnerability of the récipients and the 
possibility of obtaining their property. The process of searching and exposing might be 
repeated a number of times. If the senders succeeded in obtaining the récipients’ property, the 
last stage of victimization would occur and the swindle would end. 
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The victimization-conspiracy model is realized when the messages include tax évasion 
services, sales of pirated software, sales of falsified documents, and so on. The récipients of 
such offers are fîrstly victimized by the unsolicited messages; and if they participating the 
illégal operations, they then become conspirators of the senders. 

Because the récipients of the unsolicited messages inducing conspiracy in an illégal 
operation would expect to benefït from the coopération with the senders, the senders are more 
likely to send attractive messages of the above kind. In fact, in Nigérian firaud, the senders are 
usually personating politicians who want to transfer property (money, diamonds, and so on) to 
the bank accounts of the récipients. As a resuit, the “conspirators” of money laundering are 
finally to be victimized in the trickery. 

The phenomenon of unsolicited e-mail messages has further proved the low 
controllability or uncontrollability of the infonnation-network environment. Any e-mail 
address is vulnérable to unsolicited messages that are sent to exposed accounts on the Internet 
or to a supposed account according to the dictionary. For the senders, both ways could be seen 
as a process of searching. For récipients, both ways could also be seen as a process of 
exposing. However, these searching and exposing processes hâve become more abundant and 
colourful in the Internet environment than during pre-Internet times. 

The mere browsing of the web pages is the easiest method to get an e-mail account, but it 
is less efficient. The sender can also purchase millions of addresses of different interests of 
users from the spécifie vendors. At an inexpensive price, the buyer can conveniently reach a 
majority of these addresses. Besides, address harvesting becomes automatized and prévalent 
with the help of powerful software. Anyone with a mild computer and Internet knowledge has 
the ability to master the uncomplicated skills and subsequently collect thousands or millions 
of addresses with spécifie software, which can be downloaded from the Internet free of charge 
or with a small sum of payment. 

The exposure of an e-mail account on the Internet is unavoidable, because the exposure 
is in so broad a sense that everything in the nonnal use of the account could be seen as an 
exposing process, including the sending and receiving of messages; publishing on web pages, 
chat rooms, and BBSes; providing account information to register in online services; or 
exposing nothing more than a coincidence with a phrase from a dictionary vocabulary; or 
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merely a permutation and composition of letters and numbers so that the senders are also 
fabricated. In fact, exposure of a single e-mail account will not be so risky without the 
harvesting mechanism, because it is an inefficient way of picking up a single e-mail account 
from the Internet. However, it cannot be ignored because the e-mail account vendors could 
collect and transfer it in a dynamic process, and finally form a growing account database to 
maintain their business. The harvesting software and a dictionary attack undoubtedly deepen 
the victimization of the e-mail account holders. 

In general, the exposed e-mail account might face double risks of being victimized: 
being picked up in a formai browsing of web pages and use of other Internet services; and 
being harvested and guessed. Compared with daily-used e-mail accounts without showing up 
on the web pages or other Internet services except merely sending and receiving messages, the 
published accounts are more likely to be victimized. Therefore, it seems more likely that it is 
the process of harvesting rather than that of guessing is the one that the vendors of the 
database of e-mail accounts and senders of unsolicited messages feed on. As a resuit, the 
double risks of exposed e-mail accounts are in fact unbalanced risks: the risk of being 
victimized by collectors and harvesters is far more serious than the threats of the guessers. 

Unsolicited messages provide e-mail users with several different choices, either 
legitimate or illegitimate, either to conspire or to be further victimized by attached viruses or 
pre-established fraud traps. The majority of messages granted récipients two alternatives: to 
conspire in tax évasion, or to be damaged by viruses. 

In the case of conspiracy in tax évasion, the senders always provide valid contact 
methods to induce the récipients to participate in illegitimate activities. These offers 
seemingly aim to establish a relationship between service provider and clients. Nevertheless, 
the true effect is that they form a conspiracy. The récipients hâve to react actively before they 
become conspirators in tax évasion schemes. The process might involve repeated exchange of 
e-mail after the initial unsolicited messages. Under these circumstances, the unsolicited 
messages might be transformed into literally valuable (but morally wrong and legally 
prohibited) information. Thus, the récipients might be less averse to such messages. Such 
messages become the means of communication for the trespassers and criminals, hence 
posing great threats to social-control attempts to frustrate illégal activities. 
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In the case of viruses attack, the senders exploited social engineering to induce récipients 
to open the messages and subsequently the attachments, by blurring the sender and subject 
columns and falsifying the message contents and name of the attached files. These messages 
do not require replies from the récipients before they cause damage. They are also dangerous 
for the récipients in the sense that they are harming the récipients’ hardware and software, 
wasting the labour force, and hindering the business. 

7.3 Time factors in cybercrime 

Ail offences happen in relation to a certain time. Information Systems make a more 
efficient use of time, either in positive social actions or in négative social actions. A single 
cybercrime can be completed in a very short time, say, seconds or minutes. The simplest 
example is to modify or destruct data in a hard disk. The more complicated example is the 
possibility of transferring the U. K.’s total currency reserve in 15 minutes to another country 
(Kelly 2002). General cybercriminal offences can involve tremendous information 
transmission in a relevantly short period. For example, in R. v. Kirkwood, 233 the accused 
downloaded 934 computer games and uploaded 592 over a period of three months through his 
bulletin board, which had specialized in exchanging copyright games. 

However, préparation for some kinds of cybercrime may be time-consuming, usually 
taking several days, weeks or even months. It dépends on the attacks projected, the 
complexity of the process, and the security technology of the targeted users. The more 
sophisticated the perpétration is, the more time is needed for préparation and processing. The 
more sophisticated the security measures are, the more time is needed for overcoming them. 

Many offences are committed in a particular natural time or social time. Natural time is 
the time-span depending on the natural cycle, for example, four seasons and 12 months of a 
year, seven days of a week, twenty-four hours of a day, day and night, etc. Social time is the 
time span depending on the social cycle, for example, work time and spare time, holidays, etc. 
Circumstances are particular time-spans accompanied by natural events, such as wind, snow, 
rain, etc., or social events, such as war, riot, strike, démonstration, etc. 

233 [2005] EWCA Crim 3534 (21 December 2005). 
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In the traditional crime of bank robbery, robbers hâve generally to act when the bank is 
open, when money is in the safe, when money is being transferred by spécial vehicles. It is 
not a prerequisite for cybercrime to dépend so much on time. In principle, electronic cash can 
be “stolen or robbed” at any time, whether it is work time or not. 

Many traditional offences are environmentally or weather dépendent. In the case of 
cybercrimes, the environment and weather become less important. For example, in traditional 
larceny, when a thief walks in rainy weather, the footprint may soon be eliminated by water, 
but the footprint may be left if it is in the snow; the wind may conceal the Sound of a footstep, 
and it may be more difficult to see the thief in the dark than on a clear moonlight night. In the 
environment of cyberspace, the factor of weather is nearly irrelevant, that is, cybercrimes are 
an all-weather business. In whatever kind of weather, cybercriminals can sit at a computer and 
perpetrate whatever kind of activity without fear that victims or the third parties will discover 
him in person. 

Cybercrime can cross time-zones, so that the “time” in a day, measured by the criterion 
of law enforcement, is not so relevant in the offence. Traditional offences may be committed 
in different periods of the day, for example, stealing when it is dark, burglarizing when the 
house-owner is at work, etc. Online illégal obtaining of information and money may not be 
time-limited. However, due to strict supervision and the monitoring of online activities, the 
perpetrators may hâve to avoid the work time. 

Once successful, attacks may continue for a long time, for instance, for several weeks or 
for several months. In the case of pure illégal access and the obtaining of information from 
computers, the victim can hardly find the intrusion in the subséquent months. The intrusion 
may be repeated before the loopholes are fïxed. In addition, influences of some kind of 
viruses on whole information Systems may last for several years. Once created, viruses can 
never be annihilated and prevented from spreading. Although old viruses may become less 
harmful due to the use of anti-virus, the less protected computers can still be infected in 
subséquent years. Another example of continuing cybercrime is the Nigérian 419 firaud, which 
has been prévalent for several décades and is still a big threat to Internet users. 

Malicious programmes, firauds and some other cybercriminal tricks, once they hâve 
emerged, may be analogous to natural viruses or bacteria. They exist independently despite 
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people’s use of anti-viruses, which are like an immunity injection for human bodies. As 
viruses or bacteria may infect those for whom the injection has failed to take, the failure of 
anti-viruses may reveal the vulnerability of the Systems. The attack happens wherever there is 
a security loophole. 


7.4 Spatial factors in cybercrime 

Like traditional crimes, cybercrimes are also more or less related to the factor of space. 
The possibility of the trans-territoriality of individual cases is high. 

The phenomenon of cybercrime is distributed everywhere. In some cases, offences are 
committed in such a way that the activities take place in a distributed manner. In R. v. 
Dooley, the court found that such file sharing networks as KazaA could facilitate Internet 
users to share various kinds of files through changing computers connected to the Internet into 
servers that were accessible to other members, who then install the same software in their own 
computers, regardless of the location of the computers. 

The frequencies of these cases are different in various régions and countries. The 
objective description of the global situation proves that though cybercrime is characterized by 
its universality, it is undeniable that cybercrime cases are rare in some countries. For example 
in Finland, according to Miettinen (1996), from 1980 to the time his study was published, the 
officially-investigated hacking cases were only 10-15 in number. Although hacking cases 
involving one or two million dollars of losses also existed, the frequency and severity of the 
cases were less comparable with cases that happened in countries such as the U. S. In West 
European countries, cybercrime is also less serious than in the East European transition 
countries. 

Definitely, cybercrimes also leave some kind of traces in digital fonn and can be used as 
dues for a traceback. However, we find that cybercriminals are less anxious about traces of 
this kind than about the risks of being exposed in person. The straightforward example is a 
person who will dare to intrude into a computer in a neighbouring room through the LAN, but 

234 [2005] EWCA Crim 3093 (1 November 2005). 
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not dare to enter the neighbouring room without permission to gaze at the computer screen, 
not to mention operating that computer without permission. If a remote intrusion is in 
question, such as an unauthorized access from Europe to a computer in the U. S., the user has 
hardly any fear of being exposed or caught. Therefore, trans-national cybercriminals are less 
discouraged from engaging in these activities by the deterrence of law enforcement. 


7.5 The technological nature of cybercrime 

In the new millennium, the information economy is a popular expression used by 
entrepreneurs, while cybercrime is a popular expression used about the criminals. Many 
scholars hâve recognized the intcnsified technological involvement in cybercrime (For 
example Conly 1991; Clark 1996; Stephenson 2000; Mandia and Prosises 2003; Mohay and 
co-workers 2003; Vacca 2005; Johnson 2006). In ail cybercrimes, computers and the Internet 
are used as tools. Even if what is in question is an attack where computers or networks, or 
information is targeted, the necessary tools are still computers and the Internet, without which 
the offence may fall into the traditional offences, and cannot be classified as cybercrimes. 
However, technological involvement is a necessary but not suffïcient condition. Illegally 
assembling computers with market traded computer parts can hardly be a cybercrime. Yet, 
illegally manufacturing computer chips can be. Definitely, if traditional forces and 
technological means are combined in a certain offence, both cybercrime and traditional 
offence can run together. For example, a bank employée may be abducted and forced to reveal 
the IDs and passwords. The combined use of these means is not rare in practice. 

Certainly, the computer may not be the only tool in a certain cybercrime. For example, 
wireless networks and mobile networks provide particularly complicated ways of making a 
command to launch an attack. 

The extent of technological involvement is different in various cybercrimes, from simply 
cracking a less complex password to controlling thousands of bots ail over the world to 
launch distributed déniai of service attacks. The situation is, regardless of whether 
straightforward or sophisticated techniques or instruments are used in illégal activities, the 
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damage can always be substantial. Although the overall losses of computer misuse are 
difficult to calculate, the losses of a single victim may be overwhelming, particularly when an 
individual does not keep separate back-ups. An attack, even by a straightforward technique, 
can also resuit in serious conséquences in considering the various detailed situations of 
victims. 

In cybercrimes, in addition to the possibility of manoeuvring multiple computers, the 
available tools, means and fonctions are also numerous. In fact, much malicious software can 
be downloaded from the Internet. Many hacking techniques can be learned online. There are 
opportunities to purchase a malicious programme from the Internet as well. 


7.6 The complexity of cybercriminal activities 

The Internet allows for the communicating and planning of criminal activities in more 
different ways than in even the recent past. 235 The Internet also accommodâtes exchange of 
cybercrime methods free of charge, or provides sales of malicious programmes (Behar 1997, 
p. 66). Advanced criminal mechanisms enable the attackers to avoid prosecution or 
complicate investigations in a straightforward manner (Sofaer and co-workers 2000). This 
further enhances their universality and concealment, making law enforcement more and more 
impossible. 

Furthermore, imagine the time when there were only 20,000 computers connected to the 
Internet globally, Stoll (1988) described the process to trace the break-ins by a persistent 
computer intruder attacking Lawrence Berkeley Laboratory (LBL). The traceback took nearly 
a year of work apart from requiring the coopération of many organizations including the U. S. 
FBI and the German Fédéral Criminal Police Office, during which the intruders continued 
their activities against 450 computers and successfully gained access to more than thirty 

235 Lenk (1997, pp. 126-135). The évolution of the attack mechanism in 1982 is password guessing, 
1984 Self-replicating code, 1985 password cracking, 1986 Exploiting known vulnerabilities, 1988 
Disabling audit mechanisms, 1989 Use of back doors in programmes, 1990 Hijacking sessions, 1991 
Sweepers, 1992 Packet sniffers, 1993 Stealth diagnostics, 1994 Packet spoofmg, 1995 Graphie user 
interfaces for attack tools, 1996 Automated probes and scans, 1997 Déniai of service, 1998 Web 
attacks, 1999 Macro viruses, and 2000 distributed attacks. See Longstaff (1999, 231-255). 
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(Stoll 1988, pp. 484-497). Even then because of the complexity of the cyber environment, 
investigation of cybercrime cases was extremely time-consuming. Since then, for example, 
the case of Sean Galvez shows a worsening of the situation. He obtained unauthorized access 
to 40 eBay customer accounts and incurred up to 32,000 dollars of fraudulent charges in 2003 
could only be indicted in 20 06. 236 In comparison with cases affecting thousands or millions 
of computers, the difficulties in investigating these relatively trivial cases poses the question 
of how the prosecution of a major case is possible. 

Johnson (2006, p. 6) has discussed a digital forensic evidence on both national and 
international levels, the challenge posed by offences of online pomography, encrypted illégal 
materials, cyber terrorism, cybercrimes against children, and the exploitation of computer 
viruses in extortion schemes. He found that the process of searching digital documents was 
extraordinarily difficult, due to the capacity of rapid transmission, storage in remote 
machines, encryption, or the use of other concealment methods. In 2002 BCSC 524,~ the 
Suprême Court of British Columbia found that 102 gigabytes of data had been recovered 
through the forensic imaging of computer hard drives, which meant that the printouts of such 
a volume of data could flll a 12,500 foot high stack of paper. As a resuit, the work in 
reviewing the data was time-consuming, and required co-operation from authorities in the 
United States, Singapore, and Great Britain (paragraph 12). In R. v. Harlos, 238 the police 
seized from the offender six hard drives containing storage of 920 gigabytes of data, mostly 
child pomography: totally 3162 photographie images, and 763 videos of child pornography 
(paragraph 15). 

The Internet being a vulnérable infrastructure, ail the individual and institutional Internet 
users are exposed to similar threats of becoming victims of cybercrime. In practice, as I 
pointed out in Section 7.5, ail cybercrimes are more or less committed through technological 
means. Malicious programmes and anti-viruses are “weapons” in information Systems. 
Malicious programmes are usually designed and disseminated without rewards, being 

236 The Office of the Massachusetts Attorney General, Boston Teen Indicted on Charges He Hacked 
into eBay Accounts and Stole Victims’ Identities, 5 January 2006. Retrieved 15 Mardi 2007, from 
http://www.ago. state.ma.us/sp.cfm?pageid=986&id=l 576 

237 Full citation: In the Matter of s. 490(3) of the Criminal Code and In the Matter of Edmond Edward 
Edmond et al. 2002 BCSC 524. 

238 2005 ABPC 118. 
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uncommercialized and unsystematic. Anti-viruses are designed and sold as commodities. 
Both of them are products of labour, but with a different use: the former being offensive 
weapons, the latter being défensive weapons. 

McAfee (2005, pp. 2-13) has summarized tools and their functions in cybercrime. These 
tools are used not only to access confidential information, but also to conceal traces, and 
prevent normal functioning. Most of these tools can be downloaded from the Internet firee of 
charge or at inexpensive priées. It is especially easy to search and obtain such a programme 
from the Internet as freeware or shareware using a search engine. Many tutorials are 
furthermore prepared for non-professionals to study them systematically from primary level. 

Compared with malicious programmes, the sources of préventive programmes are fewer 
in number and more expensive on the market. To search such a programme on the Internet 
turns out to be more difficult than obtaining are firee of charge. The usual results are that the 
li nk s are redirected to a trial version with limited functions or a full version with payment 
instructions. The incentives for not revealing such programmes are profits, compared with the 
incentives for causing broader and larger damage and gaining famé by the révélation of 
malicious programmes. These cases are akin to cases of copyrights and their infringement. 

Both factors, discussed in Sections 7.5 and 7.6, can be simplified because of the 
abundant opportunities for abuse of information Systems. In fact, many practical cases hâve 
shown that rather than depending on sophisticated technologies and overcoming complicated 
processes, the perpetrators simply exploit the opportunities at hand. In Yearly v. Crown 
Prosecution Service, 239 the accused, a computer engineer, accessed without authorization a 
security document in the computer he worked on for a store and he then put it on the Internet. 
Although his computer knowledge was a condition of his employment, nevertheless, in 
obtaining the confidential file, opportunity was the most significant element rather than his 
knowledge and skills. With a malicious intent, everyone with the least knowledge of 
computer Systems but are given the same opportunity would be able to do the same. An 
offence primarily engenders by opportunity, should not be measured by the sophistication of 
techniques and the complexity of the processes involved. 


[1997] EWHC Admin 308 (21stMarch, 1997). 
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7.7 The costs of cybercrime 


Although much literature dealing with “the costs of crime” has been written by 
economists, statisticians, jurists, and sociologists, the practical estimate of the costs of one 
single offence or the whole criminal phenomenon has proved impossible to work out. 
However, the costs of crime can roughly include direct and indirect costs, physical and 
psychological costs, and both the costs before the incident and after the incident. There hâve 
been efforts to quantify the losses of computer crime, for example Wasik (1991, pp. 34-41), 
or measuring the size of the problem, for example, Grabosky (2000, pp. 8-9). In respect of 
the losses caused by cybercrime, it is overall so expensive that no other criminal activity can 
compare with it. Sometimes, the “losses” of one offence may not necessarily be a pure social 
cost. Some of the wealth may be transferred from the victim to the offender. Generally, the 
more the offender obtains physically, the more the victim loses. In some other cases where 
the offender does not acquire substantial property, mere “losses” of a victim’s money or 
health satisfÿ the offender’s psychological needs. In both cases, the offender has expected 
benefits. Again, the more the victim loses or the more seriously the victim is hurt, the more 
the offender is satisfied psychologically (see generally Section 6.7). 

Monetary losses caused by crimes, particularly by cybercrimes, are thus difficult to 
calculate. Direct measurements being unavailable, only some important references can be 
used to indicate the extent of these losses. 

As a flrst reference, because individuals and businesses hâve to invest heavily in 
information security and hâve to change their behaviour to reduce the probability of being 
victimized (Gray 1979, p. 13), spending on cybersecurity services and products constitutes, 
for example, a significant part of the losses brought about by the threats of cybercrime. 
Without cybercrime, The ICT industries do not require to invest specifically in security 
protection. In the meanwhile, investment on security protection does not increase 
productivity. Presently, this expense becomes a necessary part of their ordinary inputs. 

The second reference is that losses in individual cases provide a more direct impression. 
Daler and co-workers (1989, p. 22) reported that the average loss obtaining in a cybercrime 
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case is around 400,000 dollars, as compared with the average take in an old-fashioned bank 
robbery of 6,000 dollars. The CCIPS web site publishes a list of cybercrime cases prosecuted 
in the U. S. in recent years. It is obvious that once the cases involve losses, the amount will 
be large (dclinitcly, there are also cases not involving any monetary loss) (CCIPS 2006). 
Calculating the 115 cases prosecuted during March 1998 through to May 2006, the lowest 
single loss was 5,000 dollars, and the highest was 80 million dollars. The average loss in 
these cases was 1.27 million dollars (Li 2006). The losses involved in single cases differ from 
each other. The media, for example, reported that the infamous Love Bug of 2000, for 
example, infected at least 45 million computers and caused losses of millions of dollars. 240 

The third reference can be obtained from various cybercrime surveys, each of which 
provides some information about the situation of the respondents. For example, the annually 
operated CSI (2005) survey on 700 US computer security practitioners in corporations, 
govemment agencies, financial institutions, medical institutions and universities, found that 
the reported average financial losses resulting from security breaches are 204,000 dollars per 
respondent. The total losses for 639 survey respondents came to exactly over 130 million 
dollars (CSI 2005). 

Accurately calculating the losses of cybercriminal offences is a task of some 
sophistication (UNCJIN 1999, Paragraph 27). Cybercrime is a comparatively easy business, 
but the deterrence, in its turn, is far from easy. Notwithstanding the fact that the whole world 
is actively combating cybercrime, the number of cybercrimes is still on the rise and their 
costs are increasing exponentially (CSI 2000). In 2002, the estimation of cybercrime losses 
averaged about 50 billion dollars annually (Haie 2002, pp. 5-6). In 2005, another estimation 
of losses reached 400 billion dollars (McAfee 2005, p. 5). The meaning of this number from 
the year 2005 may be well understood if we compare it with the 9/11 attacks that cost New 
York City at least 17 billion dollars. Further, it may be pointed out that the forecast for the 
effect of terrorism in general, is a réduction of 0.25 percent of the world economy’s growth 
rate -an impact of around 75 billion dollars (Davidson 2003). If such comparions are used in 
measurements, worldwide overall cybercrimes is bleeding the economy of nearly 24 times 

240 BBC News, 4 May 2000. Retrieved 15 March 2007, from 
http://news.bbc.co.uk/hi/english/uk/newsid_736000/736570.stm 
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the sum of the 9/11 attack losses. In addition, companies are investing heavily in a variety of 
security technologies and insurance (Sofaer and Goodman 2001, p. 5). This is not unrealistic, 
if we recall that the International Monetary Fund June 2002 Global Financial Stability Report 
reflects, in a conservative estimate, the total insured losses for 9/11 of around 44 billion 
dollars (IMF 2002, p. 38). 

Besides the direct cost, Loeb has estimated that breaches of confidence can make 
companies lose more than 5 percent of their market value on average (Loeb 2004, p. 69). A 
survey by Telang and Wattal (2005) analysed the économie impact on 18 software suppliers 
and found that announcing vulnerability in one of these companies’ products caused a 0.6 
percent fall in its stock price, or an 860 million dollars fall in the company’s value (Telang 
and Wattal 2005, p. 3). 

Immeasurable are the losses of confidential information on State security, governmental 
réputation and diplomatie relationships. In McKinnon v USA & Anor, the accused 
obtained control over dozens of computers belonging to and used by the U. S. Government, 
through which he could gain further control over hundreds of thousands of computers. 
Among them were 53 Army computers, 26 Navy computers, 16 NASA computers, and 1 
Department of Defense computer. 242 Upon gaining access, the accused deleted critical 
operating Systems from sonie computers, and copied files into his own computer from some 
other, including passwords, causing a total of 700,000 dollars of loss. 243 Given there was no 
further loss from his unauthorized access, the U. S. government has been striving to extradite 
him for prosecution. The visible and invisible losses made the government unwilling to give 
up the lengthy proceedings in the U. K., even though his conviction can provide no more 
compensation for the losses. 

In general, what makes the situation worse is not only that cybercrime is expensive, but 
also that the costs are rapidly increasing. Only if it reaches saturation point, 244 can the speed 

241 [2007] EWHC 762 (Admin) (03 April 2007) 

242 ibid., paragraph 3. 

24 ~ ibid., paragraphs 4 and 6. 

244 The original meaning of “saturation point” indicates a situation in which no more people or things 
can be added because there are already too many. Summers (2003), p. 1457. In research on criminal 
phenomena, it is also possible to suppose a saturation point where a sharp increase or sharp decrease in 
the number of crimes no longer occurs. Criminal phenomena can be maintained in a relative stable 
situation if the forces of crime and deterrence are balanceable in a short term or a long term. Saturation 
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of development become stable or commence to decrease. Furthennore, in the “compétition” 
between the criminals and law enforcement, it is obvious that the former are more efficient in 
obtaining new technologies than the latter (Centre for Strategie and International Studies 
1998). 

The above analysis concentrâtes on the general impact of cybercrime on society. A 
spécial issue requiring clarification is that of the impact of cybercrime on individual victims, 
comparing a pensioner and a millionaire both of whom are undergoing 100 euros of losses in 
a cash card fraud. The direct suffering of the former is definitely far more severe than that of 
the latter. Criminal justice, equally protecting the poor and the wealthy, may reasonably be 
considered inefficient in equally treating every euro value of property belonging to every 
person. In addition, traditional crime can be léthal to natural persons, but has a less severe 
threat to legal persons in general. However, more and more businesses hâve considered 
cybercrime more likely to happen," and more harmful than physical crimes. - This is a 
natural resuit of increasing importance of information for enterprises and increasing threats of 
cybercrime to infonnation security. 

The following sections (7.8, 7.9 and 7.10) will deal with the issue of “the dark figure” of 
cybercrime. Traditionally, the dark figure has been fonned as a conséquence of the criminals’ 
self-concealment, family relationship and even froni community reasons (Radzinowicz and 
King 1977, pp. 31-34). With regard to cybercrime, besides conventional concealment 
methods, infonnation Systems constitute another significant mask for perpetrators, a shelter 
for the criminal, and a tool for hiding traces. 


in the short term is always possible. The shorter the term, the more stable the development tendency. 
Nevertheless, sometimes long-term saturation is also possible, because in the long term, the 
development tendency line appears flatter than in the short term. What is difficult is to defme short 
term and long term in research on crime. Traditional crime might be placed in a term of a century or 
millennium, while the development process of new crime should be measured in décades, years, or 
months. The dissertation does not limit what kind of term is suitable for cybercrime. 

245 IBM. IBM Survey: Consumers Think Cybercrime Now Three Times More Likely than Physical 
crime: Changing Nature of Crime Leads to Significant Behaviour-Changes, 25 January 2006. 
Retrieved 15 March 2007, from http://www-03.ibm.com/press/us/en/pressrelease/19154.wss 

246 IBM. U. S. Businesses: Cost of Cybercrime Overtakes Physical crime: IBM Survey Shows 
Changing Nature of Crime Causes Organizations to Look Inside, 14 March 2006. Retrieved 15 March 
2007, from http://www-03.ibm.com/press/us/en/pressrelease/19367.wss 
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7.8 The anonymity of the perpetrators of cybercrime 


Communicating anonymously is a great characteristic of the Internet environment. In 
using the Internet, anonymity can be kept from the beginning to the end. First, anonymous 
access to the Internet poses the most serious threat. In many countries, one of the most 
important fonns of using the Internet is realized through cyber cafés or libraries, where 
anonymous users can access many of the online services. Definitely, there exist different 
situations in different countries. Compared with Finland where there are few cyber cafés in 
towns and cities, the cyber cafés in China hâve become the “third space” of school-aged 
juvéniles besides home and school. The facilities and services in academie or public libraries 
are far less convenient for users than those in cyber cafés managed by private firms. An 
increasing number of hacking cases involving the Internet or Internet users are committed or 
conspired in cyber cafés. 

Secondly, anonymous subscription to the Internet services raises the difficulty of 
identifying users. The personal information provided for the registration of an e-mail account, 
the name and address of e-mail messages, and the authors’ information in Usenet, etc., can ail 
be fabricated. Keeping identity anonymous is favourable for the protection of users from 
victimization, but it also favours the hiding of perpetrators from being traced. 

Thirdly, users can keep their identity anonymous in the process of online 
communications. There are also mechanisms for keeping complété anonymity by which one 
user can send messages to other users, and then the messages are transmitted to the final 
target, such as newsgroup, e-mail list, or a single e-mail account. What makes it more 
complex is that in the mechanisms the intermediary can only be a programme and may be in 
another jurisdiction (Kingdon 1994). This also reminds us that there exists the possibility of 
numerous transmitting points, by which messages are transmitted from one terminal to the 
next terminal, from that to the next in line, and so on, until the message reached the 
destination. The whole process is: 

From the sender —>T1—>T2—>Tn-2—>Tn-l—>Tn. 
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Figure 6 The Transmitting Process 

Tracing this transmitting process is theoretically possible. During the tracing process, 
the investigation is exactly the contrary to the process of transmission. Each time, the 
investigator can trace back one point. The whole process is: 

From Tn—>Tn-l—>Tn-2—»...—»T2—>T1—>the sender. 


219 





Figure 7 The Tracing Process 


It is likely that ail points are identifiable. Nevertheless, as long as there is an unexpected 
element at any point, the tracing chain can be disrupted without reaching the original source. 
According to National Police Agency of Japan (1998), the possible examples include that the 
victim has no record of the Internet Protocol (IP) address; ISPs do not keep suitable records; 
hackers alter the logs; or some points are located in countries that hâve not criminalized 
hacking. As Koch (Inter@cfive Week, 10 July 2000) has pointed out, théories about détection 
remain théories, and they are too new to be tested in practice. Even if ail the work of 
traceback is fulfilled, the actual value of this work may be discounted in a judicial process 
because of different locations and thus diversified juridictions. 

Fourthly, the spécifie service or software can play further rôles in hiding users. 
Cybercriminals usually establish anonymizers, which are Systems particularly designed to 
invalidate technical identification of the source of communications. 247 In fact, this kind of 
service or software can also be conveniently obtained free of charge or at an inexpensive 

247 See Belgium’s answer to the “Questionnaire 5: Hâve you received any reports from your 
law-enforcement authorities that hâve indicated an obstruction of their work due to the non-existence 
of appropriate legal instruments concerning traffic data rétention?” in Council of the European Union, 
Council doc. 11490/1/02 CRIMORG 67 TELECOM 4 REV 1, Brussels, 20 November 2002. 
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price from the Internet. Everyone who is online can get access to these tools and services. 
Such software is likely to be replicated and spread unlimitedly, creating a bigger population 
of hidden users who potentially threaten the security of information Systems. 

Although the anonymity of cybercriminals poses a sériés of questions, it is still the core 
of the “perfect environment” for the criminals; 248 yet it is at the same time welcomed by 
Internet users. People are constantly concerned that without online anonymity, it could be 
impossible to guarantee fundamental rights (COM(2000) 890 final, p. 20; National Police 
Agency of Japan 1998). It is not strange that the European Union Data Protection Working 
Party’s Recommendation recognized that online anonymity brings about a dilemma for 
govemments and international organizations: 249 in particular, in maintaining human rights to 
privacy and freedom of expression, and combating cybercrimes (COM(2000) 890 final, p. 
20). Philip (2002) warned that anonymity can provide users with “the courage to do the 
outrageous and sometimes even resort to illégal activities.” 


7.9 Hidden victims: underreporting and unwilling to report 

Cybercriminals hâve a greater advantage than most of the traditional criminals in respect 
of the low probability of arrest and conviction. Many scholars hâve mentioned this 
characteristic of cybercrime, as noted in the literature cited in this section. Hatcher and 
co-workers (1997, pp. 397, 399.) hâve pointed out that many cybercrimes are not reported. 
The term “dark figure”, used by criminologists to refer to unreported or unrecorded crime, 250 
has been applied to dénoté undiscovered cybercrimes (UNCJIN 1999, Paragraph 30). Many 
intrusions are not detected for a variety of reasons (COM (2000) 890 final, p. 11). 


24s Levinson (2002), p. 455, saying that anonymity is exploited by perpetrators of old crimes such as 
fraud, pornography, gambling, stalking and identity theft, or new crimes such as unauthorized access, 
déniai of service, and malicious programmes, pp. 455-458. 

249 The Article 29 Data Protection Working Party (2001). 

25(1 As Radzinowicz and King (1977) pointed out that, “The recorded figures of crime are huge but the 
reality behind them everywhere looms far larger. The sinister word dunkelziffer (dark figure) was 
coined at the turn of the century to express this hidden reality.” See Radzinowicz and King (1977), p. 
42. 
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Cybercrimes can well be described as hidden crimes. 251 

At the same time, victims of cybercrime are willing to be hidden victims (Cook 1997, p. 
127). The usual “motives for silence” conceming victimization may fall into one of the 
following categories: 1. The idea that the victimization is not worth the mobilization of 
justice; 2. Involvement; 3. Pressures of fear; 4. The uneasy accessibility of police and court; 
and 5. The ignorance of events by the police (Radzinowicz and King 1977, pp. 38-40). 

In sketching the victim decision-making, Greenberg and Ruback (1985) hâve established 
a three-stage model: the victim judges whether the event is a crime, évaluâtes its seriousness 
and décidés what to do (Greenberg and Ruback 1985, as cited by Feldman 1993, p. 26). 
Before these stages, one stage that is more important should be added, that is, whether the 
victim knows the event. If this is the case, the reporting of cybercrime may remain at a lower 
level, because cybercrime is invisible and di fil cuit to discover; it is more difficult for the 
victim to judge whether the event is a crime and to estimate the losses; and the victim has less 
knowledge about whether there is an agency to report the crime. The limited reporting of the 
cybercrime has been noted more than 20 years ago by Parker and Nycum (1984, p. 313), who 
studied the invisibility of computer crime. At présent, the Intemet’s virtual environment has 
made the situation still worse. Fortunate progress in proving material évidences in traditional 
crimes was made in late 1980s when DNA tests were first introduced (Levinson 2002, p. 537). 
However, digital evidence in computer crimes is immune from such high-technological 
testing measures. The invisibility of cybercrimes is based on several factors, either 
technological or human (UNCJIN 1999, Paragraphs 30, 31). Sometimes, the simple reason is 
that the victims are not willing to report, or even do not know where to report the case 
(Salgado 2001). The documented reasons for the réluctance to take legal actions are mainly 
fear of adverse publicity, public embarrassment or loss of goodwill, loss of investor or public 
confidence, resulting économie conséquences such as the panic effect that this information 
would create on their stock prices (See Carter 1995, p. 21; Roush 1995, pp. 32, 34; Gelbstein 
and Kamal 2002, p. 2; McKenna 2003a), and exposure to future attacks (COM (2000) 890 


251 Cook (1997) used “hidden crimes” to dénoté under-reported or under-recorded crimes such as 
domestic violence, sexual assault, and racial harassment (p. 55-58). He also used “hidden victims” to 
dénoté the victims of the “hidden crimes” (p. 127). 
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final, p. 11). The UN suggested that these factors hâve a significant impact on the détection 
of cybercrime (UNCJIN 1999, Paragraph 31). 

Yet there are other reasons for the victim to keep silence. While many people are active 
in maintaining their interests and rights, some people view victimization as their own failure 
in life and career and are not willing to reveal the fact of their failure to any individuals and 
institutions, so as not to make public their own weakness. 

Therefore, it is inévitable that the rate of unknown instances of cybercrimes has 
increased as a resuit. The CSI (2005, p. 20) summarized the reasons why the U. S. 
organizations did not report intrusions to law-enforcement agencies in 2005, including 
unawareness of law-enforcement interest, a civil remedy seeming the best course, computer 
would use to their advantage, and négative publicity would hurt the image of their stock. This 
survey has indicated the percentages of respondents identifying each stated reason as being 
very important in their decision not to report computer intrusion. At the same time, it is worth 
noting that the reasons are subject to changes in each annual survey. 


7.10 The concealment of cybercrime traces 

Mitchell and Banker (1997, pp. 707-711) hâve concluded that there are four 
characteristics in which cybercrimes are different from traditional crimes, that is to say, 
difficulties in détection, limited reporting, jurisdictional complexifies, and resource constraint. 
Ail these four aspects fall under the broad characteristic of concealment. The concealment of 
cybercrimes has been brought about by other technological and human factors (Conly 1991; 
Clark 1996; Stephenson 2000; Mandia and Prosises 2003; Mohay and co-workers 2003; 
Vacca 2005; Johnson 2006). 

Most of traditional offences are highly visible due to apparent déprédations, presence of 
witnesses, and so on. There are also traditional crimes that occur in private places and 
become less visible (Walsh 1983, p. 236). Unlike traditional threats where criminals are 
physically présent at the crime scene, cybercriminals are usually not présent at the crime 
scene thus making appréhension difficult (Speer 2000, p. 260). In information Systems, 
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executing a command to delete files does not mean that the files are permanently deleted. 
What happens is merely that files are hidden due to a change in file names so that the files 
can be recovered, - ' except when a secure-eraser programme is in use. - Skilful criminals 
can disable this kind of security mechanism, and conceal the data that might possible be 
taken as evidence in prosecution. 

Technological advances hâve both a positive impact on businesses and a négative impact 
on law enforcement (Institute for Security Technology Studies 2002). For example, in the 
DrinkOrDie case, the online software piracy group concealed its actions by various security 
measures: exchanging e-mails via private mail server using encryption; using a nickname to 
identify members, and communicating about group business only in closed, invite-only IRC 
channels; the FTP sites, where tens of thousands of pirated software, game, movie, and music 
titles were deposited, were secured by particular authentication mechanisms (U. S. 
Department of Justice, Press release, 17 May 2002). On the other hand, the available 
technological solutions hâve not completely met the requirement of data collection, log 
analysis, and Internet protocol tracing (American Society for Industrial Security 2004, p. 40). 
There is also the necessity for law-enforcement agencies to recruit personnel with “electrical 
engineering and computer-science backgrounds” (Fields 2004, p. Bl); 

Inevitably, critics point out that cyber police hâve extra incentives than combating 
cybercrime, for example, asking for more money, more wiretap, bugs in computers and sell 
phones, weak encryption and permission to implement security technology, without more 
arrest following (Koch Inter@ctive Week, 10 July 2000). 

Concealment of crimes has important économie effects. Stanley (1995, p. 2) stated that 
concealment of crime can decrease the incentives not to perpetrate, and increase the costs of 
law enforcement. Concealment of cybercrime demonstrates the low probability of 

252 In United States v. Angevine (Tenth Circuit No. 01-6097, D. C. No. 00-CR-106-M, 22 February 
2002), ”the computer expert used spécial technology to retrieve the data that had remained latent in the 
computer’s memory,” though the accused had attempted to delete the relevant files. In United States v. 
Upham (First Circuit No. 98-1121, 12 February 1999), the investigator used the “Undelete” function of 
a programme to recover deleted files from the deposit media, as primary evidence in conviction. In 
Robertson v. Her Majesty's Advocate ([2004] ScotHC 11 (17 February 2004)), the police recovered 
347 deleted images from the unallocated space, and 878 images and 45 movies from deleted zip file 
within the dise. 

25j See for example, International Airport Centres, L. L. C., et al v. Jacob Citrin (Seventh Circuit No. 
05-1522, 24 October 2005), p. 2. 
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punishment. In the U. S., only one in 100 cases was detected, one in 8 prosecuted, while only 
one in 33 prosecuted cybercrimes resulted in a prison sentence. That is to say, the likelihood 
that a cybercriminal would be put into prison was a one in 26,400 chance (Daler and 
co-workers 1989, p. 22), as compared with the likelihood of imprisonment in traditional bank 
robbery a one in three chance (ibid.). Law-enforcement agencies found that a majority of 
cybercrimes never reached the criminal-justice System. Even in the relatively few cases 
where a crime was reported, most often the criminafs identity was never discovered." As a 
conséquence, as Radzinowicz and King (1977, p. 67) pointed out, “The calculation of chance 
is as applicable to the commission of crime as to many other activities.” Given other factors 
constant, if cybercrime is more concealed than other offences, the potential perpetrators are 
more motivated to take illégal actions on the Internet, and thus more offenders of traditional 
crime will be prepared to migrate to cyberspace. 


7.11 The trans-territoriality of cybercrime coverage 


Free flow of information from one country to another is a goal of information 
Systems , 255 but trans-border flow is not free . 256 The trans-border information flux is 
accompanied by risks of crime of a similar nature. In any country, the court must hâve 
jurisdiction over the person or the subject-matter of a lawsuit. This works well with the 
current set-up of law-enforcement agencies that are territorial and are operating in different 
villages, towns, districts, cities, counties, States or provinces, or national boundaries. 
Nevertheless, unauthorized access to information Systems can be accomplished from virtually 
anywhere on the networks , 257 because the communications capability of cyberspace allows 


254 Phrack magazine, Identifying Net Criminals Difficult, volume 18, number 53, 8 July 1998, article 
14, 0X1. Retrieved 15 March2007, from http://www.phrack.org/phrack/53/P53-14 

255 Directive 95/46/EC, Preamble (3); UN A/RES/51/162; Council of Europe Convention for the 
Protection of Individuals with Regard to Automatic Processing of Personal Data, Article 12. 

256 The Convention mentioned above, Article 12 provides the limit on trans-border transfer of data. 

257 See cases such as United States v. Tenebaum (Israël), 18 Mardi, 1998, involving an Israeli hacking 
United States military computers; United States v. Gorshkov (W.D. Wash) 4 October 2002, Russian 
hacker; United States v. McKinnon I (E.D. Va.) and II (D. N.J.) 12 November 2002, British National 
Hacked into the U. S. Military Networks; United States v. Zezev (S.D. N.Y.) 1 July 2003, Hackers 
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criminals to conspire more easily, without geographical proximity to one another or to the 
target (Lenk 1997, pp. 126-135). The international characteristic of cybercrime is évident 
(National Police Agency 1998). In fact, some of the cases prosecuted hâve been of this nature, 
for instance, R. v. Kozun, 258 where the forensic analysis of the computer of the accused 
disclosed that 165 separate users from 15 countries had traded through his computer. The 
computer was converted into an automated trading centre through a programme, by which 
141 users had traded in the previous 13 days. 

The sphere of legal jurisdiction makes the cybercrime enforcement more complicated 
(Lee and co-workers 1999, p. 873). Smith, Grabosky, and Urbas (2004) concluded that the 
trans-national dimension of cybercrime posed four formidable challenges for prosecutors, 
who hâve to détermine whether the conduct in question is criminal in their own jurisdiction, 
collect suffïcient evidence to mobilize the law, identify the perpetrator, and détermine his or 
her location, and décidé whether to leave the matter to the local authorities or to extradite the 
offender (Smith, Grabosky and Urbas 2004, pp. 48-49). 

Sinrod and Reilly (2000, p. 2) hâve pointed out that although some international 
organizations are examining cooperative mechanisms in the fleld of fïghting against 
cybercrime, many of their members are slow in recognizing the urgency of the situation. 

The élimination of borders favours inter-jurisdictional mobility of crime. Due to the 
actual difficulty in establishing jurisdiction, even if a certain offence is detected, it is still 
uncertain whether the way can easily lead to punishment. 259 Reasonably, suggestions hâve 
been made to incorporate cyberspace into various jurisdictional frameworks. Nonetheless, this 
needs a great deal of time, agreement, and co-operation between countries, which are still 
struggling to take coinmon actions. 


from Kazakhstan; United States v. Ivanov (D. Conn.) 25 July 2003, Russian hacker. 

258 2007 MBPC 7. 

259 In R. v. Burns ([2003] NICC 13(2) (12 September 2003)), where the accused cloned mobile phones, 
or exploited faults or loopholes in the internai phone Systems of companies or organizations to make 
cheap or free calls at the expense of those companies or organizations, the court found that: 

“As the investigation progressed it became more wide-ranging and involved another suspect and 
its ramifications were such that it eventually spread to other parts of the United Kingdom, to Tokyo, to 
South America, as well as to New Jersey and Atlanta in the United States of America. Several large 
organizations in the United Kingdom, other police forces and international téléphoné companies were 
involved. When it became apparent to the police that they did not hâve either the specialist equipment 
or the necessary expertise to access much of the information, specialist firms had to be engaged. Ail of 
this took a great deal of time.” 
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Finally, it is worth noting that trans-national cases only constitute a minor part of 
cybercrime (Li 2006). No certain conclusion can be drawn because it is possible that 
trans-national offences are not as prévalent as scholars hâve assumed. On the other hand, it is 
difficult to reveal these offences for reasons that scholars hâve laid bare. Or, it may be, that it 
is simply law enforcement does not put suffïcient emphasis on these offences. Before crédible 
data are available to give an answer to this question, we hâve certain reasons to claim that 
trans-national offences hâve sometimes of a dual nature: they do not appear as prévalent as 
domestic offences, but they are more difficult to detect and convict. In addition, because the 
investigation of trans-national offences is more expensive and time-consuming, law 
enforcement will not give more priorities to these offences than to cases that hâve happened 
“close to home”. 


7.12 The rampancy of cybercriminal phenomena 

On the computer âge, Bequai (1978, p. 4) said, the computer was a gigantic calculator 
enabling people to gain large quantity of data by pressing a button. When the computers are 
connected as a colossal network, “buttons” are used not only to acquire and transmit data, but 
also to replace some of the traditional interpersonal communications and social interactions. 
Collin (1999) explained the sense of the Virtual world, being “symbolic - true, false, binary, 
metaphoric représentations of information - that place in which computer programmes 
function and data moves.” Cyberspace has developed into a stockroom of the wealth and 
power of the information âge (The London School of Economies and Political Science 2001). 
The pervasive application of ICT can be regarded as a magnitude change of the contemporary 
society. It poses new challenges to the traditional conception and System from many aspects, 
and it changes the routine activities of a large population of the members of society. This 
change, among other effects, will benefit the disorganization of the traditional social structure 
and thus increase the presence of motivated perpetrators and the exposure of their victims. As 
a phenomenon long existing in society, crime has transformed its forms and grown steadily in 
different historical periods. Criminal phenomena hâve always gone beyond the law. New 
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forms of crime will inevitably emerge from a continually developing society, while the law is 
not ready to guard against them. The requirement for punishing crime requires a révision of 
criminal législation and a renovation of criminal justice. The persistent extension of the 
ranges of crime can but resuit in the constant extension of the regulating domain of criminal 
law. 

People longed for the industrial society in which their économie situation would be 
improved, the éducation level enhanced, consciousness civilized and traditional crime 
decreased. However, not only has traditional crime not decreased, but also white-collar crime 
came into being. Where white-collar crime was the offspring of an industrialized civilization, 
cybercrime concomitantly grew in hand with an infonnationized civilization. The 
unprecedented combination of crime and computer créâtes a stage of anti-productivity, 
undennining the magnificent prospects for high technology. Criminals abuse the conditions 
of the emerging market and technologies. 

The rise and prevalence of the Internet has become the prominent intervention factor in 
the development of cybercrime in the recent decade. On the Internet, exist universal 
contradiction and contention, use and abuse, defence and offence, ethic and déviance, fact 
and falsification, order and disorder. The powerful software and hardware that enable people 
to work more effectively is difficult to operate securely (Allen 2001, p. 2). Speedy 
technological évolution makes the vendors concentrate more of their time on the market, and 
less time on security features (Pethia 2001). Although computers and networks are at présent 
protected by various means, the emerging vulnerabilities are inevitably increasing. 

Ail these considérations conceming criminal phenomena in the background of 
high-technology development does not imply that it is the technology that brings about more 
crimes. Nevertheless, we cannot deny the factor that the adoption of the new technology may 
make the crimes more profitable, and less risky (Daler and co-workers 1989, p. 21). Even 
worse, the criminal will tend to repeat his or her criminal acts— especially when there is little 
chance of being caught or convicted. Consequently, cybercrime would pave the safest way to 
illégal profit, considering the ease with which it can be committed and the negligible chances 
of imprisonment (Daler and co-workers 1989, p. 21). 
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Even under these circumstances, arrests for cybercrimes are statistically growing, just to 
take Japan as an example. There, the total number of arrests of cybercriminals increased from 
913 in 2000 to 2,081 in 2004, while it reached 1,612 in the flrst half of 2005 (National Police 
Agency 2005). 



□ Illégal access 


■ Offences against 
Computer and 
Electromagnetic 
Record 

□ Offences using 
Networks 


Illustrated according to the statistics of the Japan National Police Agency, Conceming the 
Situation of Arrests and Consultancy of Cybercrime in 2006, 22 February 2007. 

Figure 8 Arrests for Cybercrime in Japan in the Past Six Years 

The findings of the cyber security and cybercrime survey are another way of viewing the 
situation. Australia and the U. S. hâve carried out annual survey for years. In Australia, the 
ferment years when the organizations surveyed experienced incidents or attacks against their 
information Systems were 2001, 2002, and 2003 (the answers in Figure 9 were given one year 
later). 
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The above figure is based on the statistics from the Australian Computer Crime and 
Security Survey, collected in 1997, 1999, and during 2002-2006 annually. The figure présents 
the answer to the question “Did your organization expérience computer security incidents or 
attacks against its computer Systems in the last 12 months?” This figure refers to the following 
reports, even though in each report the results of several years’ survey are usually included: 

1. Australian Computer Emergency Response Team. 2002. 2002 Australian Computer 
Crime and Security Survey, p.5. 

2. Australian Computer Emergency Response Team. 2003. 2003 Australian Computer 
Crime and Security Survey, p. 11. 

3. Australian Computer Emergency Response Team. 2004. 2004 Australian Computer 
Crime and Security Survey, p.12. 

4. Australian Computer Emergency Response Team. 2005. 2005 Australian Computer 
Crime and Security Survey, p. 13. 

5. Australian Computer Emergency Response Team. 2006. 2006 Australian Computer 
Crime and Security Survey, p.17. 


Figure 9 Security Incident Trends in Australia 

In the U. S., the zénith years of cybercrime were 1997 to 2002 (see Figure 10, the 


answers were indicators of the situation of the year previous). Both Australia and the U.S. 
show a fall in positive answers, but the victimization rates are still high. In Australia, it is 


around 20 percent. In the U. S., it is around 50 percent. In criminological language, they 
show a victimization rate of 20,000 and 50,000 per 100,000 populations. 
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□ 1996 

■ 1997 

□ 1998 

□ 1999 

■ 2000 

□ 2001 
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■ 2004 

□ 2005 

□ 2006 


Figure 10 Unauthorized Use of Computer Systems in the USA 

The above figure is based on the statistics in the reports on CSI/FBI Computer Crime 
and Security Survey done annually. The figure illustrâtes the trends conceming the 
“unauthorized use of computer Systems within the last 12 months” in the USA over the past 
11 years. 

The figure refers to the following reports, even though in each report the results of 
several years’ survey are usually included: 

1. CSI. 2000. CSI/FBI 2000 Computer Crime and Security Survey, p. 8. 

2. CSI. 2001. CSI/FBI 2001 Computer Crime and Security Survey, p. 4. 

3. CSI. 2002. CSI/FBI 2002 Computer Crime and Security Survey, p. 6. 

4. CSI. 2003. CSI/FBI 2003 Computer Crime and Security Survey, p. 6. 

5. CSI. 2004. CSI/FBI 2004 Computer Crime and Security Survey, p. 8. 

6. CSI. 2005. CSI/FBI 2005 Computer Crime and Security Survey, p. 11. 

7. CSI. 2006. CSI/FBI 2006 Computer Crime and Security Survey, p. 10. 


7.13 Rent-seeking from the exaggeration of insecurity 


The social reaction to and impression on cybercrime are broadly diversified. The general 
public who are not unfortunate enough to expérience or witness real life offences usually rely 
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on the reports of the mass media. While the mass media hâve their own interests other than 
maintaining a peaceful and secure daily life, the texts, graphies, audio and video files they 
compose and create can distort criminal incidents. Some characteristic ways of reporting 
computer crime hâve been misleading, even though they play rôles in reinforcing the public 
consciousness of security (Molnar 1987, p. 714). In observing the social reaction to crime, 
Felson (2002) coined the term “dramatic fallacy” as one of his “ten fallacies about crime”: 260 
media hâve interests in seeking strange and violent incidents to keep their ratings high, in 
which process a highly inaccurate general picture of crime is painted (p. 1). 

The tendency to dramaticize and mystify ofifences that the general public do not often 
hear about and see stems from the benefits gained by the mass media from their show-off 
through sélective reports. They choose to broadcast what they consider capable of attracting 
an audience, while at the same time they keep a silence about events in which they hâve less 
interest. The most important principle of the media is to be authentic. However, their 
authenticity is built on sélective reports. First identified by Gordon Tullock (1967), 
rent-seeking linds its way into cyberspace. Anderson (2001) has contributed to the study of 
exaggeration of cyber insecurity by pointing out in his paper that many interest groups would 
unavoidably engage in manoeuvring the truth of the cyber insecurity to benefit from the 
scared market. 

The players may include the mass media, the security engineering community, security 
professionals, police officers and even professors (Anderson 2001). Schneier (2004, pp.87-89) 
has criticized the fact that software vendors may hâve an incentive to exaggerate insecurity. 
In fact, Hoo (2005, pp. 67-69) has suggested that straightforward, cheap measures are much 
more worthwhile than large projects that many security vendors prefer to sell. There is 
definitely a problem that many organizational users leave their computers on and online the 
whole night after work, many without complex access control. Broadband networks provide a 
convenience for individual and organization users to keep online 24 hours a day, and seven 


260 These ten fallacies about crime comprise a dramatic fallacy, a cops-and-courts fallacy, a not-me 
fallacy, an innocent-young fallacy, an ingenuity fallacy, an organized-crime fallacy, a juvenile-gang 
fallacy, a welfare-state fallacy, an agenda fallacy and a whatever-you-think fallacy. See Felson (2002), 

pp. 1-18. 
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days a week. 261 Sometimes those who are their contacts can even fînd their online status in 
the chat or e-mail Systems. The 24-hour-online model is practically more risky than a dial-up 
service in terms of longer online time. 

Doing this research, I hâve found that many manufacturers of computer hardware and 
software also hâve a tendency to provide a darker picture to users when presenting the 
problem of cybersecurity. This becomes easier to understand when we recall that these 
manufacturers are striving to survive the growing threats of consumers’ awareness against the 
market of their products. In order not to subject them to product liability, they hâve to adopt a 
preparatory stance of impressing the users and judicial organs that the reason for cyber 
attacks lies not in the defects of their products but in the malicious motives of the 
perpetrators. 

While many people are motivated to exaggerate the truth, Harvey (Financial Times, 3 
December 2003) has claimed that cyber terrorism remains an insignifiant issue in real life. 
Evidence can be seen from the detailed documents such as “A Chronology of International 
Terrorism for 2004”, in which none of the incidents that caused deaths and injuries hâve 
employed or targeted computers and networks (National Counterterrorism Centre 2005). In 
fact, if we consider the urban-crime problem in the U. S., as Miethe (1995, p. 15) did, more 
than one-fourth of the households were victimized by crime in 1992, while one-half of the 
population would be victimized by a violent crime in their lifetime. The natural reaction is 
that cybercrime remains a less than prévalent fear. Although what Wasik (1991, p. 150) 
suggested that in the future information Systems can be used in cases such as murder and 
injury, the traditional “direct-contact predatory crime prédominâtes” in présent society 
(Felson 2002, p. 23). Apparently, however, the people who are currently engaged in various 
security services may more easily grasp the more powerful mass media coverage than the 
traditional offences. The Internet as a part of the mass media airing news about a new 
computer virus is far more spectacular than what traditional newspapers, radios or TV 
programme can do about a theft, fraud or murder. By ail accounts, most of the current 


261 Traditional networks are through dial-up connections. Now, two methods of broadband service are 
digital subscriber line (DSL) and cable modem service. Fiber optics, etc. are gaining ground. See 
Earthlink Inc. vs. FCC, District of Columbia Circuit No. 05-1087, 15 August 2006. 
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popular knowledge about cybercrime cornes from the mass media, regardless of the degree of 
reliability of such sources. 


7.14 Conclusions 

According to the basic conclusions of the last sections, we hâve identified a number of 
factors that complicate the reporting, détection, investigation, prosecution, conviction, and 
sentencing of cybercrime. People call for making the punishment fît the cybercrime (Vamosi 
2003). However, practicable methods of enhancing law enforcement hâve not been at hand. 

The development of cybercrime nécessitâtes a timely update of the law, as some 
countries hâve done. However, it seems that the laws implemented are inadéquate for 
effectively addressing the problem (Vamosi 2003). An example of this aspect can be found in 
the définition of firaud in U. K. The traditional fraud définition required that a person but not 
a computer be deceived (Daler and co-workers 1989, p. 125). Thus, the application of fraud 
provisions has depended on whether a person has also been deceived. These authors hâve 
mentioned that only in other countries, not the U.K. hâve the provisions on fraud been 
interpreted more broadly. 

According to the McConnell International (2000, pp. 3-6), only 31 percent of the 
countries surveyed had substantially or fully updated their laws, 15 percent partially updated, 
while more than half of the countries had no updated laws. According to the principle of 
legality, the absence of a law punishing cybercrime sets the deterrent probability at zéro, 
while the actual punishment is also zéro. This being the situation, the expected utility of the 
offender equals the utility when he or she is undetected. By recognizing this benefit, the 
potential perpetrators will hâve a greater incentive to commit cybercrime than other offences. 

As the conclusions of McConnell International (2000, p. 8) hâve demonstrated, light 
punishments create limited deterrence. The possible reason why creating a virus carries 
lighter penalties than marijuana offences (McCullagh 2004) may be due to the elasticity of 
these two kinds of crime from the economists’ point of view. Unlike the marijuana offences 
that are inelastic, cybercrime is more elastic. Tougher punishment for drug crime will be less 
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effective than for cybercrime. However, considering the marginal deterrence when the effect 
of punishment is too weak to stop cybercrime, this definitely does not deter, either. Lack of a 
certain degree of severity in punishment will not prevent potential criminals from committing 
the crimes they are planning, because even if they are probably caught, their expected benefit 
will still be higher than the expected cost. It is the marginal deterrence of the punishment but 
not the elasticity of the crime that is working. 

However, at the same time, methods adopted in some countries cannot be completely 
explained by the above theory. Take the example of the application of long-term 
imprisonment for offences with a low détection probability. The expenses of the long-term 
imprisonment are quite huge. Thus, it may be said that under these circumstances, 
govemmental investment is insufficient when the emphasis is put on punishment, and 
détection is ignored. This relates to the value orientation of the government. 

Some other countries completely violate the principle of rational choice. They seem to 
find it difficult to afford adéquate funding for détection, conviction, and enforcing 
punishment, while on the other hand they hâve established a cyber police, employing huge 
police forces. The tasks of these cyber police include détection and evidence collection, as 
well as cybercrime prévention with techniques and human resources, forming a “cyber 
information dam”. The expense is also huge. As Dnes (2000, p. 75) pointed out, it is of very 
poor value to increase the probability of conviction through employing more police officers. 

In these countries, the concerns about the privacy of individuals hâve to give way to 
national security and the maintenance of social order. This means that in the information âge, 
the public organs receive ever greater powers of surveillance and interception. Since the 
1990s, the terrorists hâve frequently launched attacks; and individualism is gradually being 
submerged by the voice of national interests and international co-operation. The rôle of 
punishment in the deterrence of crime is undoubtedly unearthed. Whether in poor or wealthy 
countries, severe punishment is being used universally for cybercrime. This can be explained 
as decreasing the expected benefits of cybercrime while increasing the expected costs, 
forcing the offenders to give up committing the offences and to select instead legal activities. 
This implies that the means the modem countries take to decrease crime are direct prévention, 
plus increasing détection probability and increasing punishment severity. 
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Nevertheless, the following factors deserve further considération. First, it remains a 
doubtful question as to whether the information dam can effectively control the information 
flood. The filtering and blocking of infonnation is expensive and ineffective. As a substitute 
for severe punishment, it is either a necessary waste of democracy (compared with 
over-criminalization), or a necessary limit to democracy (compared with information 
freedom). In order for cybersecurity to be maintained, the private sectors and the public 
authorities should cooperate to strengthen the legal frameworks for cybersecurity (McConnell 
International 2000, pp. 8-9). 

Secondly, a surer answer can be provided to the question of whether severe punishment 
is cheap. There hâve been hundreds of studies done conceming the cost of the death penalty, 
proving that the death sentence is expensive as well as being easy to execute the innocent. 
These hâve become common-sense reasons for repealing the death penalty. The cost of 
imprisonment is also high. Because the cost of severe punishment is costed differently in 
different countries, the législature and law enforcement hâve a different tendency in 
implementing various degrees of severity in implementing punishments, which can bring 
about further jurisdictional problems. 

Finally, what should be researched is whether severe punishment is effective. Given that 
the probability of détection remains extraordinarily low, and that there is no appropriate 
approach to increase it, a severe punishment again runs up against a limitation. A severe 
punishment to some extent requires the support of the probability of détection. If not, it loses 
the basis on which it exists and delivers little deterrence at ail. 

Cybercrime differs from traditional crimes in its universality, anonymity, concealment, 
and complexities. While quantitative évaluation of cybercrime has proved difficult, the fight 
against cybercrime has become a big burden for companies. Because of difficulties in 
détection, investigation, and conviction, the dark figure of cybercrime remains high. The 
harsher penalties should be applied to pursue effective deterrence, but in themselves they do 
not serve protection. 

In effect, we are still repeating Radzinowicz and King’s dilemma (1977): the perpetrator 
may escape détection, the detected perpetrator may escape arrest, the arrested perpetrator may 
not be brought to book due to lack of evidence, the perpetrator brought to book may be 
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released because his innocent context or trivial offence, the prosecuted perpetrator may escape 
conviction, and the convicted perpetrator may only be imposed a light penalty (p. 41). 

The thèmes explored in this chapter show that there is no easy way of bringing 
cybercriminals before the judicial process. Nevertheless, as the next chapter will show, the 
increase of cybercrime is constant, and the reinforcement of deterrence is a constant need, yet 
for these two forces to reach equilibrium is still an on-going process. While Chapter 8 deals 
with temporal dimension of the phenomenon, Chapter 9 concludes that there is a time-lag in 
criminalization, but mainly turns to the spatial dimension to discover the problems existing 
among the various juridictions. 
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CHAPTER 8. UNBALANCED SCALE: THE HISTORICAL DEVELOPMENT OF 


CYBERCRIME AND DETERRENCE 


8.1 Basic observations on the development of criminal phenomena 


After revealing multi-dimensional obstacles in dealing with cybercrime, this chapter will 
présent a retrospect of the history of cybercrime and relevant legislative and judicial 
practices. 

“History is full of nightmares, some natural, some manmade.” (Clarke 1997, p. 223) 
Nightmare or not, the computer raises problems. The computer was an invention that people 
could not imagine until it was clear what it happened to be. Before the digital computer had 
been invented, Thomas Watson, the fonner chairperson of IBM predicted in 1943 “I think 
there is a world market for maybe fïve computers.” Although different answers to questions 
“what exactly is a computer?” and “how many générations of computers hâve been 
developed?” are still running parallel, 262 it is widely accepted that the first electronic digital 
computer was invented in the 1940s, in the final years of World War II (Hamilton 1973, p. 
82). The more notable example is the Electronic Numerical Integrator and Computer 
(ENIAC), invented in the U. S. in 1946 and since then, according to Tarkhov (1999), 
computer technology has experienced four générations. 263 


262 According to National Conférence of Commissioners on Uniform State Laws, Uniform Computer 
Transactions Act (UCTA, Amended 2000, 2001), the computer is defmed as “an electronic device that 
accepts information in digital or similar form and manipulâtes it for a resuit based on a sequence of 
instructions.” Section 102 (9). However, under different définitions, the computer might be a different 
device. The general sense of a computer today is a device related to the electronic processing of digital 
data. 

263 Tarkhov, S. Générations of the Computers: From Lamp Monsters to Integrated Chips, September 
1999. Retrieved 15 Mardi 2007, from http://www.bashedu.ru/konkurs/tarhov/english/generat.htm. The 
timelines are: lst Génération in 1950s, 2nd Génération from 1959 to 1963, 3rd Génération from 1963 
to 1975, and 4th Génération from 1975 to today. There are also other arguments. For example, Grauer 
(2001, pp. 7475-7476) argues that the first génération of computers before the 1960s was characterized 
by electronic tube and later transistors; the second in 1970s, miniaturized integrated circuits; the third 
in the 1980s and early 1990s, a very large-scale intégration of circuits; the fourth since the 1990s, 
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Along with the continuous development of infonnation technology, computer crime 
may, in principle, hâve been taking place since the very invention of the computer, but at that 
time, it neither became a significant problem nor caused great concern. Meanwhile, the 
development of computer crime should hâve kept pace with computer technology. The 
computer developed from a calculator to a word processor to a multimedia device. Besides 
the research on the history of ICT (Cortada 2002), the history of the computer (Allan 2001; 
Kuck, 1978, pp. 52-72); the history of the Internet (Okin 2004) or of online information 
services (Boume and Hahn 2004), and history of computer ethics (Bynum 2001), scholars 
hâve also explored the history of cybercrime (Overill 1998), and particularly, the history of 
the hacker (Thomas 2002; Peterson 2003; Raymond 2001, covering 1945 to 1990s), or the 
viruses (Dvorak and Pirillo 2004). Some scholars hâve researched into the history of the 
législation on cybercrime. Ulrich Sieber (1996), for example, concluded that countries hâve 
adopted various forms of législation, and undergone several waves from the 1970s, 
addressing different problems respectively. They provide a valuable foundation for analysis 
in this dissertation. The different focuses in these researches do not deliberately furnish any 
organic li nk s between the development of cybercrime and the development of deterrence. Yet 
these links are denoted as the primary concern of this chapter. 

The chapter attempts to carry out a diachronie inquiry into the history of cybercrime and 
législation. Cybercriminal phenomena and the deterrence of punishment through law 
enforcement and social prévention are undergoing a process of development. The history of 
cybercrime can roughly be divided into four stages: a stage of germination, a stage of rapid 
development, a stage of broad expansion, and a stage of routinization. Furthermore, the 
criminal-law reform relating to cybercrime has never been completely synchronous with 
cybercrime due to a hystérésis in both the law enforcement and législation compared with the 
relevant criminal phenomena. 


8.2 Computer hackers’ discovery of a lawless new frontier 


dominated by a very fast growth of Internet users. 
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Upon the hypothesis that computer crime emerged soon after the invention of the first 
computers, the first stage of computer crime began from the late 1940s and lasted through the 
late 1960s, when the general public paid more attention to usability, utility, efficiency, and 
development of the computer, and considered that the computer System was “occasionally 
unreliable,” but “usually secure” (Dunlop and Kling 1991, p. 524). Unlike today’s universal 
use of computers, there was hardly a computer “market” in this early stage. The manufacture 
or installation of a computer is an expensive and time-consuming work. However, during this 
stage, computer crime emerged in the context of a limited number of computers in use, but 
the législature did not provide any spécifie countermeasures against the phenomenon, leaving 
law enforcement to deal with it within the traditional legal framework. 

Earlier studies implied that electronic computer” crime most probably emerged in the 
fields of military, engineering, science, finance and commerce at the beginning of the 1950s. 
Nevertheless, the earliest documented computer abuse, which involved the alteration of bank 
records, occurred in 1958 (Parker 1989, p. 5). The case became the first Federally prosecuted 
computer crime in the U. S. in 1966, with a time-lag of eight years. It was revealed that a 
bank employée had utilized the institution’s computer to embezzle cents from interest on 
long-term accounts (ibid.). The financially motivated employée created a criminal precedent. 

Within less than two décades, worldwide computer installations increased from four 
hundred at the beginning of the 1950s to 60,000 at the end of the 1960s (Hamilton 1973, p. 
82). Even so, the scarcity of the new machine still attracted potential users to hack, to gain 
access, and to utilize unauthorized computer time. The tenn “hacker” in the traditional sense 
was not regarded as computer crime, but as essentially pertaining to computer security. The 
rise of the hacker culture can be dated to 1961 when the Massachusetts Institute of 
Technology acquired the first computer used for commercial time-sharing (Digital 
Equipment Corporation (DEC), Programme Data Processor-1, 1963). The expensiveness and 
rareness of computers necessitated a shared use of these machines to extend their utility as 
widely as possible, in which the boundary between authorized and unauthorized use was 
vague. However, at the same time, a security concem originated due to the breach of access 
control (Association for Computing Machinery Professional Knowledge Programme 1997). 
The exploited processing ability, loss of computing time and even waste of electricity 
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alarmed computer owners. Notwithstanding, the computer Systems were not generally 
confronted with threats as serious as the phone Systems were. In conséquence, the U. S. took 
action to prevent tampering with the phone System (Meinel 2004). Being an early fonn of 
hackers, phreakers’ intrusion into and interférence with the télécommunications System 
became a kind of punishable offence. 

War has been the perpétuai inventor in history. Although the apparent causal relation 
between the Cold War and the ARPANET was not widely acknowledged in available 
literature, the latter was surely a product to deal with the threats of a “Hot War” against data 
transmission System. The advantage of this invention was that even if one part of the System 
was destroyed by war, particularly by nuclear weapons, the System could function in its other 
parts through rerouting (Okin 2004, particularly, p. 132). The Internet began in the 
mid- 1960s as a programme created by the U. S. Department of Defence to build a 
decentralized network that would provide a communication between various sectors of the 
govemment in the event of nuclear war or an attack on the U. S. (Hafner and Lyon 1998, pp. 
10-14). The nature of the Internet determined that it was connected primarily to some 
important institutions, but was not open to the general users. An intrusion of the networks 
would endanger interests that were mainly military and those of advanced science and 
technology. 

At the beginning of this first stage, there was neither cybercrime nor cybercriminal law 
in the social and legal environment. When the first computer crimes occurred, no law was 
ready to deal with them (Chen 1990, pp. 71-86; Nelson 1991, pp. 299-321). With the 
emergence of the cybercriminal phenomenon, the principle of “nullum crimen, nulla poena 
sine lege” was applied to protect the fundamental rights of the perpetrators from punishment 
outside the law. Except for the reluctant application of old laws, there was neither a 
cybercrime prohibited by law nor a law enacted against cybercrime. Lack of punishment 
reduced the expected cost of the criminals, which were composed thus of moral costs and 
substantial costs, specifically, the perpetrators’ necessary devices and labour in cybercrime. 
Because there was no cybercrime law, there was neither expected punishment nor the 
expected cost induced by the expected punishment. Under such circumstances, the 
probability of conviction equalled zéro. The expected utility of the perpetrator almost 
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equalled the utility of a situation in which crime went undetected or unpunished. According 
to an économie analysis of crime (Becker 1968, pp. 169-217), those who are risk-indifferent 
are indifferent to détection and conviction. For those who are risk-lovers, cybercrime 
becomes a new cause, a new chance, a new challenge, and a new type of risk (see also 
chapters 2 and 3). For those who are risk avoiders, because of the low risk of détection and 
conviction rate of cybercrime, they transfer from other offences to cybercrime. Therefore, the 
number of cybercrimes and perpetrators will inevitably increase. 

Apart from the gap in législation when the first cybercrime emerged, law enforcement 
had insufifïcient capacity to deal with it. However, they tried towards imposing punishment 
through application of existing laws. These provided for a preliminary deterrence on 
cybercrime, which could be used to deter the potential ofifenders of existing types of crimes 
proscribed by existing laws, but was inadéquate to deter potential offenders of the types of 
crimes not proscribed explicitly by law. The principle of legality and the limited possibility of 
the législation restrained the coverage of the law and law enforcement, leaving considérable 
loopholes and having little deterrence on offences that remained untouched by law. As a 
resuit, deterrence brought very low expected costs for these perpetrators. 

At the same time, existing laws were applied to the limited number of computer crime 
cases in countries such as the U. S. In fdling the legal gap, the passage of computer crime 
législation by States lagged behind computer abuses, and did not happen in this period. 
Furthermore, the debate about computers and personal infonnation only began in the late 
1960s (Wood 1982, p. 111). The debate did contribute to providing some fonns of deterrence. 


8.3 The rise of the law against the increasing number of cybercrimes 

Following the First stage, the subséquent two décades fonn the second stage, which 
began from the 1970s and lasted to the end of the 1980s, during which along with 
individuals’ and organizations’ increasing dependence upon computers, the threats of 
computer crime increased. The general tendency was that computer crime continued to 
increase in volume with a change in methods, while a legal response also began to emerge. 
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Understanding of the nature of the computer continued developing. In a British case, R. 
v Wood, the court held that “The computer was used as a calculator, a tool which did not 
contribute to its own knowledge but merely carried out a sophisticated calculation which 
cannot hâve been done manually.” 264 It was not a rare situation that even many 
commentators doubted the acceptability of the computer, predicting only with extreme 
carefulness that: “The electronic computer would be technology’s most successful machine 
were it not for the difficulty that people hâve in accepting it.” (Hamilton 1973, p. 81) Others 
already began to long for the “post-industrial society” (Bell 1974), where the computer would 
not only be broadly used but also be addictively depended on. 

Technological thought developed fast in changing the image of the computer in the 
1970s, from a bulky mainframe that 11 lied a building to a computer in a desk; and in the 
1980s, from a desktop to a host of old and new devices (Mosco 2004, p. 21). The focus of 
this philosophy is that: “The computer would be growing in power while withdrawing as a 
presence.” (ibid.) The philosophical imagination and the technological development of new 
intelligent instruments were propelling an information révolution. Comparatively instant and 
cheap, an e-mail message could be sent from New York to San Francisco in less than a 
minute for about one dollar, as Fetherolf (1982, pp. 216-217) said. The futurist Castells bore 
witness to the fact that: 

“We are in the middle of a major technological révolution that is transforming our ways 
of producing, consuming, organizing, living, and dying.” (Castells 1985, p. 11) 

While technology advanced beyond the ability of the average citizens’ understanding, 265 
the operation of computers remained straightforward and vulnérable to criminal manipulation 
(Bequai 1979a, p. 107). According to Bequai, computer crimes during this period fell into 
five key categories, specifically, vandalism, theft of infonnation, theft of services, theft of 
property, and firaud (1979a, pp. 106-107). Both the merely psychic satisfaction and the 
pecuniary gains motivated users to practise unauthorized access to the machines, or to 
information in the machine, hacking for use only being a less guilty act. In fact, before the 
1970s, “using” computers without authorization was more excusable because the available 

264 R. v Wood [1982] 767 Cr. App. Rep. 23. 

265 State ex rel. McCleary v. Roberts, 88 Ohio St.3d 365, 2000-Ohio-345. 
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computers were still insufficient. Later in the 1980s, more computers were available and it 
became unnecessary for general users to intrude into others’ Systems. Therefore, 
unauthorized “use” of computers no longer provided an excuse and became labelled “abuse” 
in legal terms. 

During this period, there were only some fragmentary reports of computer abuses and 
accidents. However, the less bulky, low-cost computer attracted an unprecedented number of 
hackers with various motivations. Computer crime was comparatively new and authorities 
reacted in a sluggish manner. It was found that the threat of computer crime was pretty 
relentless. For instance, the average loss of computer crime was dozens or hundreds of times 
that of conventional crimes, regardless of whether the hackers obtained monetary benefits or 
psychological satisfaction. 

Within this stage, the tenn “cyberspace,” flrst coined in a fictional work by William 
Gibson (1984) to describe the environment within which computer hackers constructed a 
Virtual community, became prévalent. In 1978, nevertheless, a perpetrator deprived a bank of 
10.2 million dollars in the Rifkin case (Forester 1990, p. 263). In 1982, a group of hackers 
intruded into a computer with records of cancer patients’ radiation treatment, modification of 
which might threaten the lives of these patients. Murder became realistic with the computer 
as a tool (Milhorn 2005, p. 59). In 1986, Stoll uncovered an international espionage 
conspiracy (Longstaff and co-workers 1997, p. 234). These cases expressed again the 
potential threats of the hackers against property, life, and State security. 

On the other hand, the development of computer technology, which was designed for 
social welfare, also constituted a significant source of threats to the social order. Similarly, 
the history of technology has been filled with dilemmas of such a kind. For example, 
primitive weapons may exactly be productive tools and vehicles may be hijacked. What was 
going to happen -unfortunately- in the field of computer science was that something 
destructive would be invented. For example, Dan Edwards coined the tenn “Trojan Horse” in 
1972, denoting an apparently benign macro or utility with undocumented side effects, which 
may be security violating or palpably destructive (Overill 1998). The Trojan horse caused 
great security anxiety with institutions such as the military (ibid). 

Although it is not an exclusive argument, it has been broadly acknowledged that it was 
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in 1984 when Fred Cohen defined a computer virus in his paper (1984). The threat of 
malicious programmes such as a Trojan Horse, a virus, a worm, and a logic bomb, ail came 
into being during the 1980s, and necessitated the first business of anti-virus in 1988 (F-secure 
2005). These soft offensive and défensive weapons were expected to play their rôles in the 
information warfare in the near future. 

The computer network still played a tiny rôle during this period. As Clarke (1984) 
pointed out: 

“Even for highly developed countries, these [data and computer networks] are still in 
their infancy, though they undoubtedly represent the wave of the future.” (p. 27) 

Nevertheless, computer security incidents increased steadily with the development of 
computer networks. Losses due to computer crime had been incessantly escalating. In 1980, 
losses from computer firaud and other abuse of computer Systems in the U. S. alone were 
estimated to exceed 300 million dollars (Wood 1982, p. 69). In contrast, although software 
theft found its way in 1964 (Forester 1990, p. 3), and in the late 1970s, large-scale piracy 
became cominon due to the use of the personal computer and packaged software (Forester 
1990, p. 4), there hâve been very few breaches of privacy reported (Wood 1982, pp. 
118-119.). 

In the early 1970s, according to Sieber (1998), most developed countries introduced 
laws criminalizing computer crime. More laws and régulations were implemented in more 
countries in the 1980s. Within this period, ail of the Nordic countries had their 
data-protection laws in place. 266 Countries made every effort to eliminate legal gaps to 
punish cybercrime. The characteristics of legal countermeasures during this stage were that: 

There were merely fragmentai computer crimes and fragmentai législations; 

Législation concerning computer crime was generally concentrated in a developed 
country; 

New crimes such as time theft posed considérable contradictories in the fîeld of law 
(BloomBecker 1981, pp. 16-17); 


266 Such as Swedish Data Act 1973, Norwegian Data Registers Act 1978, Danish Freedom of 
Information Act 1985, Finnish Personal Data File Act (Act 471/1987), and Icelandic Act respecting 
Systematic Recording of personal Data 1989. 
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Laws were not effective enough (See Dierks 1993, pp. 307-342; see also Rosenblatt 
1990, p. 35), and there was a general “lack of deterrence” (Bequai 1978, pp. 5-6). 

In short, at the second stage of the development of cybercrime and deterrence, 
cybercrime was in its growth period, with both the extent of cybercrime and the supply of 
perpetrators increasing. Although the costs of cybercrimes were continually increasing due to 
the increasing législation and law enforcement, they were lower than other well-punished 
crimes. Thus why rational criminal investors rushed into the new field. Countermeasures 
against the increasing crimes increased deterrence, which represented an increased 
probability of détection by new police forces and an increased severity of penalty through 
new laws. In the development of the struggle between cybercrime and punishment, most 
types of cybercrimes emerged and to a certain extent were deterred. 


8.4 A legal System wrestling with networked adversaries 

The pace of cybercrime became faster and faster. The third stage roughly covered the 
whole of the 1990s, when cybercrime expanded and the relevant législation was broadly 
implemented. During this period, personal computers entered homes and offices throughout 
the developed world and even in the less-developed countries (Mosco 2004, p. 2). Bill Gates’ 
The Road Ahead (1995), Nicholas Negroponte’s Being Digital (1995) ail concentrated on 
building a new world in cyberspace. Tapscott (1996) announced that: 

“Today, we are witnessing the early turbulent days of a révolution...A new medium of 
human communications is emerging, one that may prove able to surpass ail previous 
révolutions...in its impact on our économie and social life.” (p. xiii) 

Although the information révolution was processing with different styles in countries at 
a different économie level, the impact of computers on society seemed to be reaching into 
every aspect of social life (Mosco 2004, p. 18). Alongside the scientists who were hopeful of 
the new development, the politicians in addition attempted to connect computer 
communication, économie growth, democracy, and a better environment. As Al Gore said: 

“...[W]e will dérivé robust and sustainable économie progress, strong democracies, 
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better solutions to global and local environmental challenges, improved health care, and...a 
greater sense of shared stewardship of our small planet.” (Gore 1994) 

However, since the 1990s, cybercrime had entered a rapid process of globalization. 
Initially funded by the government, and limited to academie and official uses, the interest in 
the commercial use of the Internet began to be satisfied from the early 1990s; since then, 
computer networks hâve attracted great public attention (Kollock and Smith 1999, p. 3). The 
U. S. introduced the concept of the National Infonnation Infrastructure (NII) to “unleash an 
information révolution” (Rowland 1998). With the invention of the WWW, access to the 
Internet was available to average users. The growth of the Internet was surprisingly fast. 
From then on, global computers connected to and users acquiring access to, the Internet were 
confronted with threats from a globalized cyberspace. Following the last stage, cybercrimes 
hâve developed into forms that are more complicated. The cyberspace where perpétra tors 
lived, the virtuality that they wanted, the cable by which they were linked, the knowledge that 
they had acquired, the tools that they invented, and the platfonn on which they shared 
information provided criminals of different degree of sophistication with new incentives. 

Personal information could be caught during the transmission process. Personal 
computers could be attacked during voluntary surfing of the Internet. Web sites could not 
only be tools by which attacks were carried out, but could also be targets for attacks. 
According to the statistics by Alldas.de, about 72 web sites were defaced by 47 attackers in 
1998, about 1,079 web sites defaced by 430 attackers in 1999 (Li 2003). The General 
Accounting Office reported 250,000 attacks against the U. S. Department of Defence 
computers in 1995 . 267 These numbers represented different aspects of the situation of risks 
and threats on the Internet. 

Cybercriminals also found their way into electronic communications, such as the e-mail, 
the abuse of which became an advertising means for underground marketing, or an annoying 
forum. The large-scale unsolicited e-mail became known as spam (Kelly 2002), which has 
been converted into one of the side products of electronic marketing. 

267 Union Calendar No. 468, the 104th Congress, second Session, House Report 104-861, Fédéral 
Government Management: Examining Government Performances as We Near the Next Century 
Eighteenth Report, by the Committee on Government Reform and Oversight together with Additional 
and Minority Views, 28 September, 1996. 
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Moreover, a sériés of attacks from malicious programmes happened (Drummond and 
McClendon 2001), and web sites suffered great threats. The businesses of anti-virus and of 
the security services continued developing. By 1990, many anti-virus products were 
introduced from big companies. To some extent, this indicated that the security-induced cost 
of individual and organizational users had further increased. 

The victimized entities began to report enormous losses caused by the infringement of 
intellectual property. Many web sites, software authors and ordinary Internet users adopted 
various ways of transferring and exchanging pirated works. The infringement of copyright 
text, audio, video and multi-media works had entered a stage that seemed impossible for any 
of the existing authorities to control. 

Cybercriminals attacked various private and public targets ail over the world, in respect 
of which some hacking investigations were successful in arresting the perpetrators. In the U. 
S., the FBI opened 547 cases of “computer intrusion” in 1998, while the number of such 
cases increased up to 1,154 in 1999 (Freeh 2000). The financial crisis in Asia and a sériés of 
bankruptcies of big enterprises also alerted attention to the fact that cybercrime could bring 
about disasters to the global economy. 

Starting from this period, with the rapid rise of the Internet, the influence of the Internet 
on cybercrime began to be considered in législation, the contents of which became rich and 
the range of which was expanded. The graduai formation of international harmonization 
affected some national législation. Computer crime and relevant législation was globalized, 
expanded from developed countries to less developed countries and to developing countries. 
Law enforcement also took a sériés of measures against cybercrime. For example, in 1990, 
the U. S. organized a nationwide crackdown on cybercrime, leading to successful arrests, 
criminal charges, a dramatic show-trial, a number of guilty pleas, and massive confiscations 
of digital evidence and equipment (Sterling 1994). 

From the above analysis, it can be found that at the third stage of development, 
cybercrime tended to be saturated and the growth rate was thus decreasing. To reach this 
stage, most types of cybercrimes emerged and been criminalized, the probability of détection 
had reached a higher level, severity of punishment had reached a higher degree, and most 
potential users of computers and networks were connected, leaving little space for the 
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undeterred types of cybercrime. The marginal benefits of one more case of cybercrime was 
going to decrease, while the marginal costs of one more case of cybercrime was going to 
increase (for general theory about marginal costs and marginal benefits of crime, see Becker 
1968; for modem application of this theory, see Cooter and Ulen 2003). Therefore, 
cybercrime tends was being saturated. At this stage, deterrence continued to increase to a 
certain extent, until it reached the completeness, specifically, the optimality of marginal 
utility. 


8.5 The equilibrium between cybercrime and deterrence 

Although the commencement of the year 2000 witnessed a surprising breakdown in the 
network economy boom (Mosco 2004, p. 45), the cybercriminals did not demonstrate any 
sympathy with the dot coms 268 nor with the stock markets. The fourth stage developed 
roughly from the year 2000, when cybercrime was becoming routinized, and the legal gap 
filled. 

The large-scale Déniai of Service attack against high profile web sites created great 
panic in society about the Internet infrastructure (Levinson 2002, pp. 524-525). A long list of 
viruses that were written by people who were in juridictions where there was no law against 
hacking, that were written by means of spécifie software, which included multiple methods 
of attacking, that caused billions of dollars of losses, and that disabled anti-virus products, 
indicated the seriousness of the threat and the necessity for the countenneasures (See Katyal 
2001, pp. 1003-1114). 

In contrast to these anarchist attacks, the advance-fee fraud induced the victims to 
transfer money voluntarily to the criminals. The advance-fee fraud, or 419 fraud, which was 
named after the applicable section of the Nigérian criminal code and was committed in a 
more organized manner, has victimized people from around the globe. 269 The average 

26s Dotcom dénotés “a commercial company that opérâtes through the Internet.” See Daintith (2004), 
p. 163. 

269 Nigérian Criminal Code, Chapter 38, Section 419 simply provides for the crime and punishment of 
fraud: 
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Nigeria 419 victim has lost 5,575 dollars, making 419 fraud one of the most costly financial 
frauds for individuals (Fager 2002, p. 20). 

As to the increase of web sites, attacks against web sites rapidly increased. According to 
the statistics of Alldas.de, about 4,394 web sites were defaced by 2,255 attackers in 2000, 
while about 4,797 web sites were defaced by 667 attackers in the First season of 2001 (Li 
2003). The defacement of web sites became a significant problem comparable with graffiti 
Street buildings. 

The quantity of cybercrime incidents and malevolent attacks has, nevertheless, fallen 
from year to year since 2001. According to a survey conducted by the CSI and the FBI in 
2003, general financial losses totalled, from 530 survey respondents, 201.7 million dollars, a 
sharp drop from the previous survey total of 455.8 million dollars. In the 2004 survey, overall 
pecuniary losses totalled, from 494 survey respondents, 141.5 millions dollars (CSI 2004). In 
2005, the survey indicated losses, from 639 respondents, that totalled 130.1 million dollars 
(CSI 2005, p. 14). The reasons for these reduced figures were not clear, but the improved 
security measures, law enforcement, législation and international coopération may ail 
contribute to prevent cybercrime. 

Many developed and developing countries hâve implemented cybercrime laws. From 
the point of view of International harmonization, the Convention on Cybercrime entered into 
effect on 1 July 2004. Starting from the 9/11 attacks, a serious international concern about 
cyber terrorism was brought about the by large-scale distributed déniai of service attacks, 270 
and it spread among governments, législatures, law enforcements, and academia. 

At the fourth stage, due to the decrease in the marginal utility and increase of the 
marginal cost of one more crime, and the constant increase in the means of deterrence, total 
number of cybercrimes has shown a prospect of decrease in so far as the potential perpetrator 


“Any person who by any false pretence, and with intent to defraud, obtains from any other person 
anything capable of being stolen, or induces any other person to deliver to any person anything 
capable of being stolen, is guilty of a felony, and is liable to imprisonment for three years. 

If the thing is of the value of one thousand naira or upwards, he is liable to imprisonment for 
seven years. 

It is immaterial that the thing is obtained or its delivery is induced through the medium of a 
contract induced by the false pretence. 

The offender cannot be arrested without warrant unless found committing the offence.” 

270 Distributed déniai of service is a form of déniai of service launched from many computers in 
different locations. See Daintith (2004), pp. 159-160. 
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realizes the fall in the optimality of benefit from cybercrime (for general theory about 
marginal costs and marginal benefits of crime, see Becker 1968; for modem application of 
this theory, see Cooter and Ulen 2003). The cybercriminal will, additionally, hâve to take 
higher risks than before. It turns out that risk-avoiders will retreat from cybercrime, that those 
who are risk-neutral and risk-lovers will also discover it less attractive to commit cybercrime 
than other crimes, and tend to discontinue their adventure. Under such circumstances, the 
deterrence exercised by législation and law enforcement can ultimately be recovered. 

8.6 Conclusion 

During recent décades, society has experienced a fast and frightening increase in both 
information Systems and information transgression. The development of cybercrime follows a 
route of innovation of the ICT, générations of computers, enlargement of the networks and 
emergence of anti-security techniques. The faster the speed of infonnation processing is, the 
broader the network connection covers, the more users are engaged in the information 
industry, and the more dépendent on infonnation modem society becomes, the higher the 
risks and the more serious the threats people will hâve to face. Naturally, the number and 
gravity of cybercrime will also increase. However, any increase will not be limitless. 

The basic summary of the historical scene revolving around cybercriminal phenomena 
présents us with the reality that the increase of both cybercrime and deterrence remain 
unbalanced. In a word, people do much, but not enough. 
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CHAPTER 9. DILEMMAS IN THE CRIMINALIZATION OF CYBERCRIME 


9.1 Introduction 

Previous chapters hâve placed on the scale many weights on the side of factors 
favourable to crime. From this chapter onwards, I am starting to recover the balance by 
adding more weights on the other side of the scale where the préventive factors are located 
and doing this mostly by revealing the différences and difficulties in legal development. 

This chapter will flrst explore a time-lag in criminalization, stated in Chapter 8, Section 
8.6, and which is still one that falls into the temporal dimension. The other sections will be 
devoted to exploring the spatial dimension of criminalization, that is, the différences between 
the various countries. 

The general objective of the legal framework is to promote the welfare of human beings. 
In particular, the functions of criminal law hâve been designed to protect society from harm, 
deter crime, and maintain the legitimate rights of the criminal. The practical threats of 
cybercrime that the contemporary society is confronted with necessitate régulation by 
criminal law. As the Govemmental Proposai of Finland HE 135/2006 pointed out, the new 
provisions on cybercrime in criminal law will hâve the fonction of improving the penal 
protection of electronized infonnation and communications, to provide the authorities with 
more efficient tools to deal with cybercriminality, as well as to improve the legal status of the 
victims of cybercrime. 271 

However, there is neither a ready-made model for every country to follow, nor a uniform 
format for use. Establishment of a set of unprecedented rules for a new phenomenon costs 
more time, money and labour, possibly causing more imbalances between power and rights, 
inconsistency between laws and reality, and contradiction between existing law and new law. 
The process of criminalizing cybercrime is proving to be an arduous task. The infonnation 

271 HE 153/2006, General Justifications, 4. Effects of the Proposai. 
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âge facilitâtes social transformation and legal diversification; therefore, laws cannot be 
immobilized for too long. This chapter analyses the factors that cause a time-lag in the 
process of criminalization, that cause international différences, and that cause the différences 
between criminal phenomena and législation. The chapter also illustrâtes the prospect of 
diversified models and contents of international criminalization and points out its influence on 
international assistance in criminal justice. 


9.2 The time-lag in criminalization 

The criminalization of cybercrime is implemented through the amendment of existing law 
or the création of new law. Compared with the changing social reality, laws are relatively 
stable. Criminalization is not implemented always as instantly as the transfonnation occurring 
in cybercriminal phenomena. Change of social condition and criminal phenomenon is 
accelerated by the indescribable innovation of ICT, but the legislating process is limited by 
interest conflict and by continuai disputes and debates. The virtually unrestrained 
development of the technological context of society constantly outpaces the restricted 
évolution of the legal System. Although législatures are apparently more rational than 
criminals in the sense that ail people are rational and their choices are different in legal 
matters, rational criminals can at ail times act ahead of the more rational législature. 
Subsequently, the time-lag in législation is unavoidable. We can identify the following 
primary factors: 

Firstly, criminal phenomena are developing rapidly with social change. The advance of 
modem society is propelled by technological innovation. As a social phenomenon, the 
development of cybercrime is integrated into ail ingrédients of society. They are changing at 
the same rhythm. Crimes in which information Systems play different rôles are emerging, 
with an increasingly short cycle. The development of such phenomena is solely limited by 
technological factors but not by human and social factors. While criminal phenomenon is 
dynamic, law is stationary for a short period. Législation cannot be updated in time to reflect 
the changed social condition. For example, the first computer crime case of the U. S. occurred 
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in 1958, was discovered in 1966, but the first law punishing computer crime was passed as 
late as 1984. Similarly, the first computer crime case in China happened in 1986, nevertheless, 
the earliest provision on computer crime took effect only in 1997 when the Penal Law was 
amended. The one or more décades of time-lag in criminalization indicate that the 
perpetrators of cybercrime hâve not been sufficiently detected and that the users of computers 
and networks hâve not been adequately protected during the intervals (see Chapter 8). In 
practice, many other countries than China still hâve no law or no effective law penalizing 
cybercrime but are full of suspects, perpetrators and conspirators of cybercrime. 

Secondly, unlike most traditional offences that the State proscribed under a clear-cut 
criterion in respect of their harmful nature, many cybercriminal offences involve disputes 
between interest groups, which lead to interest conflicts in criminalization. Criminalization, 
decriminalization, and anti-criminalization interweave in a complex dynamic process. Many 
factors that the législature must consider and balance hâve to be taken into account during the 
process of criminalization. In such a process, although the most preferential element is the 
maintenance of social order, the législature must as well consider issues involving both 
protection of human rights and deterrence of potential crimes. 

The législature also needs to consider the prospective technological development and 
interests of different players in information society. The idéal practise should be to enact law 
in such a way that illégal activities are punished, while legal activities are protected and 
encouraged. However, the judgment of deciding what is legal and what is illégal is not a 
straightforward problem in modem society. Unlike traditional crimes, mala in se, such as 
murder, larceny, and arson, which hâve been considered as breach of morality, most of 
modem offences are mala prohibita, that is to say, statutory offences. To détermine whether 
to punish an activity or not, increasing considération is focused on the way the benefit is the 
bigger, to punish or not to punish, or to punish the wrongdoer or to victimize the welldoer. 

In the ICT industry, a universal anxiety is that a strict régulation on activities of 
developers and service providers would hinder the development of technology and the 
economy. They require a comfortable legal environment to carry through their innovative 
strategy. Because ICT represents a new direction of social advancement, the current legal 
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framework apparently leaves an IT industry an adéquate discretional space. Therefore, strict 
liability and vicarious liability hâve not been imposed in this early stage. 

Occasionally, the legislative process becomes a tangle between different interest groups, 
particularly in regulating ICT industry and imposing liability on ICT enterprises. In the strict 
sense of observing the legislative process conceming cybercrime, between public power and 
private right, public power seems the more powerful; between the private rights of institutions 
and individuals, the right of institutions seems more powerful. Forces of a certain interest 
group are powerful enough to oppose and prevent the adoption of a bill. For example, the 
corporate liability of cybercrime confronts a situation in which the Internet service providers 
reject liability imposed by provisions other than the service agreements. On the other hand, 
evidence has proved that search engines are cooperating with governments in censoring 
online contents, messages, and monitoring activities worldwide. Supplementary of explicit 
responsibility and liability for Internet enterprises will be a reality eventually. However, at 
présent, it will take more time to weigh the interests of the public and private sectors, between 
the individual and organizational players, and between service providers and consumers. 

Thirdly, législation is relatively stable. It is stabilized by the législature in an arduous 
lawmaking process: drafting, debating, revising, lobbying, voting, and signing into law. The 
process of législation lasts long enough to maintain stability - a status of remaining 
unchanged before successive législatures over time, during which period victims and law 
enforcers are waiting for legal amendment, while perpetrators are going unpunished. Each 
new criminal phenomenon has to be discussed and argued for a long time before clearly 
defining its concept, constituents, categories, scope, degree, and suitable punishment. 
Législation has to be drafted carefully and debated intensely before it can be passed so as to 
ensure the seriousness and stability of the legal System. Spécial care should be taken in the 
process of criminalizing cybercrime. A law that cannot balance between interests and benefits, 
human rights and State powers, cost and effectiveness is not necessarily better than unruliness. 
The législation on cybercrime, therefore, has always been a long-term task. 

With a better understanding of cybercriminal phenomena, the countries that hâve passed 
laws flrst may be modelled on by other countries. The country that legislated later may hâve a 
better basis in terms of availability of either cases or materials for reference, and thus their 
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process of législation may be shortened. When we read the laws of some English speaking 
Commonwealth member countries, we can find that the provisions in their law are usually 
modelling the U. K. law. The législation resources of these countries hâve naturally been 
time-, cost- and labour-saving. However, this represents only a spécial example. For most 
countries, there is not such a model to follow. When a model law is translated into other 
languages, when the spirit of such a model law is expressed by a set of different conceptions, 
and when the contents are understood by people with different legal traditions and social 
backgrounds, these countries again will “create” different versions of laws. The impossibility 
of a worldwide model law naturally increases the diffïculty of drafting appropriate législation. 

The discussion about criminalizing cybercrimes is further interwoven into the 
argumentation about the refonn of criminal policy. The humanitarian tendency of modem 
criminal policy is accompanied by a decriminalization of victimless offences in many 
countries, including the retreat of criminal law from areas of conduct relating to alcohol, 
drugs, sex, and gambling (Feldman 1993, p. 4). At the same time, the increasing influence of 
scientific and industrial advances on human safety and social security hastens the 
criminalization of new types of crimes (Feldman 1993, p. 5). The process of identifying 
various cybercrimes is inevitably complicated by a changeable and unsolvable disputation on 
social values. This further prolongs the legislative cycle. 


9.3 International différences in criminalization 

Whereas cybercrime is possibly trans-territorial, the problem of deterring cybercrime 
must be considered against the international background. The commonness and individuality 
of the législations in various countries influence transnational investigation and conviction of 
cybercrime. However, the central concem is that criminalization also meets the problem of 
différences between countries in the sélection of technical terms, classification methods, and 
provision of constituents, promulgation of penalties, divergence of jurisprudential notions, 
and diversity in the validity of the laws. The most significant factors include: 
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First, conceptualization is the starting-point of any législation, which should include 
well-defined tenninologies. Within législation in a domestic language, obstacles will not be so 
large that understanding and comparison become a problem. However, in the international 
context a semiotic issue emerges as an implicit dynamic to create legislative différences. This 
question can be translated into the différences in comprehending the exact meanings of 
technical terms. The différences between traditional conceptions and native languages 
detennine the différences between the technical terms used in the législation, apart firom the 
problems of the multiplex infonnal wordings. To measure these différences, when we try to 
translate these tenns firom different languages into one language, the meaning of the original 
tenns may change a lot. From the nature of language and translation, exact compréhension of 
these terms in a benchmark language is not possible. Only a rough approximation in 
understanding is available. 

In the case of cybercrime law, the general name of “cybercrime” can also be expressed as 
“computer abuse,” “computer misuse,” “computer crime,” “computer-related crime,” “crime 
by computer,” “computer-facilitated crime,” “hacking,” “Internet crime,” “online crime,” etc. 
in English alone. There are as many different terms denoting “cybercrime” in some other 
languages as well. 

Furthermore, the linguistic différence exists in every aspect of describing the 
phenomenon of cybercrime. In English-speaking countries, the mens rea of illégal access is 
prescribed as “intentionally” in Australia and New Zealand, but as “knowingly” in the U. S. 
These two words are explained in most dictionaries as synonymous, that is, as “deliberately.” 
However, if we translate these two words into other languages, for example, Chinese, the 
understanding of them would be different. “Intentionally” is generally translated as a term 
with the meaning of “doing deliberately, doing actively”, while “knowingly” is generally 
translated as the term with the meaning of “doing when knowing clearly.” The emphases in 
them are different. 

Secondly, législation in different legal Systems, such as in the Common-law System, the 
Roman-German law System, the Scandinavian law System, the Islamic law System, the 
Chinese law System, etc., and in different countries of a certain legal System, are determined 
by many factors, such as culture, religion, régime, etc., to create a unique typology of 


257 



cybercrime. Therefore, there is a reality of typological différences, which exist in the 
categorization of cybercrimes when criminalized. Only laws in a few countries hâve a full 
coverage of cybercrimes, such as the U. S. Most countries hâve criminalized some of the 
publicly recognized offences, such as illégal access to information Systems, online firaud, etc. 
Sonie other countries implement very principle-bound provisions, such as Myanmar, where 
severe punishment is imposed on any person who carries out an act “which undermines State 
Security, prevalence of law and order and community peace and tranquillity, national unity, 
the State economy or national culture.” 272 In many countries, there is totally no law 
regulating cybercrime. These countries are not able to cooperate in law enforcement due to 
the lack of relevant provisions in their substantive laws. Under such circumstances, it is 
impossible for these countries to cooperate successfully in investigating an urgent cybercrime 
case. Even if they hâve an extradition and assistance mechanism, the substantive law obstacle 
makes it impossible to take any trans-border action against a trans-border offence. So if the 
laws are different, the requirement of “double criminalization” should be eliminated, as it was 
done in the Council of Europe Convention on Cybercrime. 

Thirdly, différences exist in prescribing the constituents of cybercrimes. Besides different 
technical terms and varied définitions of the scope of the coverage, différences between the 
constituents of a certain offence in different countries are also likely to pose obstacles for the 
international harmonization of législation and for the coopération of law-enforcement 
agencies. The Convention on Cybercrime is a model of international implémentation, but in 
granting member States discrétion in deciding whether they intend to criminalize certain kinds 
of offences, or in requiring certain kinds of constituents for a certain offence, it may leave 
loopholes in the législation at the State level. The ELI Framework Decision on Attacks against 
information Systems (12 May, 2003) correctly recognized that: 

“There is a need to achieve a common approach to the constituent éléments of criminal 
offences by providing for common offences of illégal access to an information System, illégal 
System interférence and illégal data interférence.” (Preamble (11)). 


7 Myanmar Computer Science Development Law, The State Law and Order Restoration Council 
Law No. 10/96, The Eighth Waxing of Tawthalin, 1358 M.E., 20 September 1996. 
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Fourthly, différences exist in the legal penalties for cybercrimes. Traditional principles of 
penal law require that the severity of penalties matches the seriousness of the offences: light 
penalty for a light offence, and severe penalties correspondingly for a serious offence. 
However, the situations in different countries are very diversified. An offence may be 
regarded as the most serious threat to public order in one country, while in other countries it is 
thought to be minor nuisance. 

The laws of different countries are also likely to provide penalties of different gravity for 
the “same” cybercrime. The différence between penalties may be caused by such factors as: 
the différence in the traditional starting-point and in the range of punishments in the entire 
penal law as well as in the différence between attitudes towards the hannfulness of 
cybercrimes. In each country, if a cybercrime involves hann to the State interest, it will draw a 
more severe penalty. For example, espionage has always been punished by the most severe 
penalty. However, as far as common cybercrimes are concemed, between the different 
countries, the starting-point of the penalty may clearly differ. Many countries provide 
imprisonment of firom two months to several years for different offences or different 
circumstances of the same offence. In some countries, the penalty is more severe. For 
example, in Mauritius, the penalty for computer misuse is penal servitude for a tenn not 
exceeding 10 years and a fine not exceeding 100,000 rupees; in aggravated circumstances, 
that is, when the data contained in the computer is suppressed or modified or the operation of 
the computer is altered, the penalty will be penal servitude for a tenn not exceeding 20 years 
and to a fine not exceeding 200,000 rupees. 273 In Singapore and the U. S., imprisonment for 
not more than 20 years is also possible for a cybercrime. 274 

Fifthly, Chapter 3 Section 3.2.4 discussed the fact that différences exist between notions 
concerning online content and activities. Jurisprudential conceptions in each country are 
unique and incomparable, particularly concerning what constitutes a cybercrime and what 
does not, and what kind of a situation draws a severe or light punishment, etc. In China, 
offences against State security are of great concem to the criminal-justice System. If messages 


273 The Mauritius Information Technology (Miscellaneous Provision) Act 1998, Act No. 18 of 1998, 
Penal Code Section 369A. 

274 1 8 U.S.C. § 1030 (c) (4) (C). 
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were published online involving propaganda and instigation upsetting State security, author 
and publisher are both held liable. Similarly, in sonie other countries, racist, fascist, and hâte 
speech are strictly censored and prohibited. However, some other countries where these 
messages may be protected by clauses on freedom of speech according to their State 
constitutions. These différences make trans-national prosecution and international assistance 
impossible. International actions are certainly intended to eliminate différences. Nevertheless, 
these actions will certainly be resisted by tradition, which may not be expressed in explicit 
language. 

Sixthly, laws hâve their own lives. Let us borrow the legal realists’ concept about law in 
the book and law in action. A Law in a book may seem excellent, but that law in application 
may cause embarrassment. Différences exist between the validity of laws. The problem is that 
cybercrime havens not only exist in countries without law, but also exist in countries with 
laws. That is to say, law and law enforcement hâve different functions and play different rôles 
in different countries. Some countries strictly adhéré to the principle of legality where neither 
the innocent is punished nor the criminal connived at. In some other countries, laws are not 
uniformly enforced at this time or that time, upon this person or that person, in this case or in 
that case, and by this agency or agent or by that agency or agent. While cybercrime is not 
territory-bound, law enforcement is always territorial. The législation gap is worsened by the 
law-enforcement gap. 


9.4 Différences between criminal phenomena and criminalization 

The criminalization of cybercrime is also different from the actual criminal phenomena 
due to the limited coverage of législation, the changeability of categories and methods of 
cybercrime, the influence of a changing constitution on legal constituents, and the influence 
of a changing sense of gravity on the legal penalty. The main différences comprise: 

Firstly, that criminalization has a limited coverage compared with criminal phenomena. 
While the change of cybercriminal phenomena is very fast, coverage of criminalization is 
always limited to existing offences. In other words, criminalization is bound by the reality of 
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a relative fixed period, but the phenomenon is not bound by this reality. The scope of 
cybercrime is constantly extending, with unexpected tendencies and an uncertain future. 
Législation has only a limited capacity to predict. Once passed and enacted, législation will 
commence to hâve an increasingly longer distance from the reality. In the face of a rapid 
development of cybercrime, the coverage of législation will soon become narrower than the 
reality. 

Secondly, categories and methods of cybercrime are changeable, while laws are relatively 
stable. Categories of cybercrimes are changing and sometimes difficult to grasp during the 
préparation for a legislative bill. Definitely, this does not mean that there will be new 
categories or methods everyday or every month. It does mean that the update cycle of 
categories and methods of cybercrime is faster than the possible update cycle of the law. In 
some cases, new categories emerge or new methods are used suddenly, without any omen and 
waming. In recent years, the most shocking events in real society may be the 9/11 attacks on 
the U. S. In incidents relating to infonnation Systems in the Virtual world, the breaking out of 
the viruses has a similar effect. For example, the Philippine boy who created the Love Bug 
exploited his motherland’s legal gap at large. 273 Although sometimes a technological reaction 
against a new virus can be in place several hours after the attack has commenced, and at other 
times législation on a new cybercriminal phenomenon can be drafted in several weeks, there 
is still a time-lag, that is, the différence between the time of the attacks and the time it takes to 
change the law. 

Several years ago, when action was taken to prevent computers from infecting viruses, a 
major concern was to be careful not to open a floppy disk with contaminated files or e-mail 
with an attachment containing viruses. The reliable countenneasure was to impose 
responsibility on the operators to check viruses before opening a disk or an e-mail. Those who 
failed to do so were subject to a charge of négligent liability. After several years, floppy disks 
are no longer the major medium for spreading viruses. The e-mail remains the primary 
spreader, but most service providers are armed with an automatic examination System and 

275 The suspected viras author was Onel de Guzman, who escaped prosecution due to the absence of 
cybercrime law in the Philippines when the offence was committed. See Graham Cluley, Cybercrime 
and Punishment, Computer Weekly, 29 November 2001. Retrieved 15 March 2007, from 
http ://www. computerweekly. com/Article 10818 8 .htm 
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classify clean e-mails and contaminated e-mails for users. When there is a contaminated 
e-mail, the automatic System will delete it and user cannot open it any more. Therefore, the 
operators’ liability seems less critical in this case. The obligation and subséquent liability on 
the service provider become urgent. Similar examples in the field of cybersecurity and 
cybercrime should be carefully considered in legal reforms. 

Thirdly, the seriousness of cybercrime changes fast and has its influence on the legal 
penalty. The traditional principle of criminal law requires that punishment be proportionate to 
crime. When a kind of offence initially emerges, its gravity cannot be recognized in its 
entirety at flrst. If a law does not hâve the full coverage of the gravity of the situation, it may 
be faced with the need for an urgent amendment after a short period of enactment. A notable 
example is the déniai of service attacks. This tenn became popularized only in recent years 
due to the distributed déniai of service attacks. However, the tenn can be found in books 
published more than two décades ago. That is to say, déniai of service had less harmful forms 
and less conspicuous effects. Countless losses and the danger of bankruptcy for giant online 
enterprises gave publicity to this fatal offence. If the previous law did not even contain a 
clause to punish the offence, the législature has to take action to penalize it. If the previous 
law contained a clause to punish the offence with a lighter penalty, the législature has to 
penalize it more severely. The law must be adapted to the development of social 
requirements. 


9.5 Diversified criminalization models 

Everything concerning criminal law, specifically, defining, classifying, grading, 
prohibiting, and punishing, is in the hands of the législature of each jurisdictional unit. 
Criminal law has struggled to keep up with the expanding technologies of cyberspace (See 
Lessig 1999; Katyal 2001). More and more countries in the world hâve enacted computer 
security laws and statutes, starting though from different viewpoints. Cybercrime is treated as 
a spécial type of crime and spécial statutes are required to define cybercrimes (Brenner 2004). 
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The Cybercrime Act of Australia, 

The Computer Misuse Order of 2000 of Brunei Darussalam, 

The Law on Automated Data Processing Crimes no. 19.223 of Chile, 

The Law No. 679 of 2001 on Abuse and Pornography of Minors on the Internet of 
Colombia, 

The Criminal Justice (Theft and Fraud Offences) Act 2001 of Ireland, 

The Criminal Damage Act of Ireland, 

The Act of Unauthorized Access to Computer Systems and the Internet of Japan, 

The Act of 15 July 1993 relating to the reinforcement of the fîght against financial crime 
and computer crime of Luxembourg, 

The Computer Crimes Act of Malaysia, 

The Computer Misuse and Cybercrime Act 2003 (Act No. 22 of 2003) of Mauritius, 

The Crimes Amendment Act 2003 No 39 Part 1 s 15 of 7 July of New Zealand, 

The Commonwealth Cybercrime Act 2001, 2002, 2004 of Pakistan, 

The Prévention of Electronic Crime Act 2007 of Pakistan, 

The Criminal Infonnation Law 1991 of Portugal, 

The Computer Misuse Act of Singapore, 

The Computer Crime Act 2003 of Sri Lanka, 

The Computer Misuse Act of 2000 of Trinidad and Tobago, 

The Cybercrime Law No. 2 of 2006 of United Arab Emirates, 

The Computer Misuse Act of the U. K., 

The Police and Justice Act 2006 Chapter 48 (November 2006) of the U. K., 

The Computer Fraud and Abuse Act of the U. S., 

The Spécial Statute against Computer Related Crimes of Venezuela, and 
The Computer Misuse and Crime Act 2004 of Zambia, etc. 

In countries with penal codes, the criminal statutes can also revise the general provisions 
of the penal code in the meantime and fulfil the process of criminalization. 

The fourth model is that of inserting criminal clauses into non-criminal statutes. In these 
non-criminal statutes, the législature usually binds several criminal-law clauses together so as 
to criminalize cybercrimes. With its emphasis on effïciency in législation, this fonn of 
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criminal-law reform has been widely taken up by more and more countries, for example, in 
China, the Standing Committee of National People’s Congress passed Decisions on 
Maintaining Internet Security in 2000, criminalizing a wide range of cybercrime. The 
Personal Data Protection Act 2000 of the Argentine, the Privacy Act of Austria, etc. also 
include criminal clauses. In many other countries, some kinds of data protection laws were 
implemented early in the 1970s and thereafter, partly covering punishment for déviant 
behaviour against automated data processing. 

The flfth model is that of legal interprétation. The application of law requires 
interprétation. The power of interprétation, nonetheless, is generally distributed between 
different agencies, for example, the législature and judicature, which can interpret laws 
effectively for different situations. In some countries, there is no spécifie process for law 
interprétation. Laws are only interpreted by the courts in particular cases. Therefore, judicial 
interprétation is combined with court decisions. In some other countries, regardless of 
whether the precedents hâve binding force or not, independent judicial interprétation is 
exercised by the Suprême Court and Suprême Procuratorate. 277 These organs publish spécial 
documents to interpret spécifie problems in applying the laws and régulations made by the 
législature. In China, in order to punish cybercrime, the Suprême People’s Court ruled in 
2001 that capital punishment may be applied to those who provide State secrets to foreign 
individuals or institutions via the networks and cause particularly serious hann. Sometimes, 
laws are criticized because of the vagueness of the legislative language used. For example, in 
the U. K. law, key words like computers and data hâve not been defined under the Computer 
Misuse Act of 1990.The worry is that such deliberate omissions may lead to incorrect 
decisions, which may complicate the existing problem. 


277 For example, in China, according to the Standing Committee of the National People’s Congress 
Resolution on Reinforcing the Task of Legal Interprétation (passed in the 19 th Session of the Standing 
Committee of National People’s Congress on 10 June 1981), the Standing Committee of National 
People’s Congress is responsible for interpreting laws and decrees, while the Suprême Court and the 
Office of the Suprême Prosecutor are responsible for interpreting issues arising in the practical 
application of laws in the trial work of the courts and procuratorial work of procuratorates separately. 
If the interprétations of the Suprême Court and the Office of the Suprême Prosecutor show différences 
in principle, the issue has to be reported to the Standing Committee of the National People’s Congress 
to interpret or décidé. 
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The sixth model is that of using judicial precedents on cybercrime. Connnon-law 
jurisdictions follow the principle of stare decisis. Precedent decisions hâve a binding force for 
the cases decided thereafter. Criminal-law reform is largely propelled and achieved by these 
decisions. Such decisions are closely linked to the interprétation of laws and régulations. 
Precedential decisions usually lead to the application of laws and régulations. A decision can 
also lead to the repeal of laws by claiming that they are unconstitutional. Therefore, 
precedential decisions can also lead to the exclusion of certain laws and régulations, as in the 
cases where some of the U. S. online crimes acts were challenged and linally removed by a 
court decision. 278 

The seventh model is that of administrative-law provisions relating to the criminalization 
of cybercrime. Provisions and orders promulgated by administrative organs constitute a part 
of the criminalization System of cybercrime at least in some countries. These provisions and 
orders provide définitions of terms used in législation, and conditions under which certain 
conduct is legal or illégal, and sometimes, create a “hnk” between cybercrime and a separate 
article of a clause containing penalties in législation. In China, the State Council promulgated 
the Ordinance on Security Protection of Computer Information System in 1994. 279 The 
Ordinance prescribed legal liability for an act of: 

Violating the security-ranking protection Systems of computer information Systems, and 
threatening computer infonnation Systems; 

Violating the registration System of computer information Systems in international 
networking; 

Not reporting cases within the prescribed time that hâve occurred in the computer 
information Systems; refusing to improve after receiving a notice from the public security 
agency requiring an improvement in the security situation; and 

Other acts threatening computer infonnation Systems. 280 


278 For example, in several cases, the courts found that the term “indécent” in the U. S. 
Communications Decency Act of 1996 was unconstitutionally vague or that the CDA was 
unconstitutionally overbroad. See Satterlee Stephens Burke & Burke LLP, Obscenity and Pornography 
on the Net, n.d. http://www.ssbb.com/obscen.html 

279 Ordinance on Security Protection of Computer Information System, State Council Decree No. 147, 
18 February 1997. 

280 Ibid, Chapter 4. 
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These acts are punishable by public security for admonition or rectification upon stopping 
the computer. 281 If the act violâtes the public-security System, it is punishable according to 
the Régulations on Public Security Management; if the act constitutes an offence, it falls 
within the Penal Law. 282 

The eighth model is that of comprehensive législation. This model has similarities with 
the criminal clauses in non-criminal law. However, this model is more comprehensive than 
the above non-criminal law. The distinction between these two categories lies in that 
non-criminal laws primarily deal with the protection of rights or maintenance of social order, 
and the punishment of déviant behaviour, while the comprehensive laws deal with issues 
relating to the facilitation of certain activities, protection of rights and maintenance of social 
order and punishment of déviant behaviour with emphasis on the facilitation. 

Currently, some countries and régions are implementing comprehensive laws in order to 
solve legal problems in cyberspace. Among these laws are: 

The Electronic Transactions Act 1999 of Bermuda, 

The Télécommunications Act 1999 of Bhutan, 

The Law 67/2002 on Electronic Commerce, Companies and Data Messages of Ecuador, 
The Multimedia Act of Germany, 

The Télécommunication Ordinance of the Hong Kong Spécial Administrative Région of 
China, 

The Infonnation Technology Act 2000 of India (No. 21 of 2001), 

The Computer Law of Ireland, the Computers Law 1995 of Israël, 

The Infonnation Technology (Miscellaneous Provision) Act of Mauritius, 

The Electronic Commerce Act of Malta, the Electronic Transaction and Digital Signature 
Act 2004 of Népal, and 

The Electronic Communications and Transactions Act of South Africa (Act No. 25, 

2002 ). 

The Multimedia Act of Germany is one of the examples of comprehensive législation. 
Judged by the content of German law, it is ail-inclusive, covering télécommunications service, 

281 Ibid, Article 20. 

282 Ibid, Article 24. 
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digital signature, criminal punishment, breach of order, legal liability, distance learning, and 
price indication etc. Since the Internet technology is still developing, new legal problems are 
endlessly emerging; the Multimedia Act of Gennany will definitely be under constant 
révision in the future. 

A better example of such comprehensive law is the Philippines Republic Act No. 8792, 
titled “An Act Providing for the Récognition and Use of Electronic Commercial and 
Non-Commercial Transactions, Penalties for Unlawful Use Thereof, and Other Purposes.” It 
directly reveals its comprehensive nature. 

Although the original idea of multimedia law regulating cyberspace problems belonging 
to different legal branches by comprehensive législation is a welcome development, it cannot 
be accepted by most countries due to the sheer inability of bridging the complexity and 
technological nature of cyberspace problems. At présent, the usual practice of countries is 
either to interpret current laws, to revise current laws, or to create new laws. After long-tenn 
studies and research, the U. S. enacted a digital signature act, a public-networks maintenance 
act, an encryption-technique protection act, a prohibition of electronic theft act, as well as a 
sériés of acts criminalizing cybercrimes. Where there is a requirement to revise a law, only 
corresponding articles and clauses require révision, but the whole law does not require to be 
changed. In contrast, the project of a finalized comprehensive législation is too huge and the 
révision is difficult. 

9.6 Conclusion 

Information Systems and the criminal phenomena relating to them hâve and will hâve a 
deep impact on the legal System. Along with globalization, legislative activities hâve been 
expanding to alrnost ail countries. Effective international countermeasures are also being 
implemented by different international organizations. International harmonization, 
particularly the European Convention on Cybercrime, contributes greatly to forming a greater 
consensus in respect of the législation of relevant countries. 

Différences in types and corpus delicti of offences provided in different countries cover 
the subject, object, mens rea, actus reus, and other conditions. Crucial divergence in 
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substantive criminal law still obstructs a trans-national criminal justice. It is believed that 
heavier penalties are better able to combat crimes. However, the situation in the world is 
becoming more complicated, because under a certain similarity in the theoretical framework 
and laws, there are also varying définitions of a detailed nature that greatly influence the 
identification and punishment of offences. 

The legal traditions, cultural contexts, ideology, and international relationships ail 
constitute difficulties in coordinative international-law enforcement. There is still a necessity 
for cybercrime législation. Either old law or new law, either domestic législation or 
international harmonization should be used to meet social requirements and fill legal gaps. 

The discussion in this chapter demonstrates that the criminalization of cybercrime, both 
over time and over space, is still developing and improving. Two of the most significant 
issues must be tackled with priority: liability and jurisdiction. The following two chapters 
will discuss these two questions separately. 
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CHAPTER 10. LIABILITY FOR CYBERCRIME 


10.1 Introduction 

Crime induces a reaction, the liability that people impose on this phenomenon through 
established forms of law enforced by State agencies. Criminal law is an entity subject to 
incessant changes, depending upon the competing process of two opposite factors, crime, 
which represents a socially destructive force, and deterrence, which represents a socially 
constructive force. Consequently, criminal law is not composed of exactly the same 
components such as existing offences and punishments between one year and another, though 
the System remains the same. The change has usually been graduai so that no obvious 
différence can be perceived except over long intervals of time. 

However, présent society is undergoing so rapid a change through ICT that an obvious 
comparison can easily be found. Different rôles of infonnation Systems in cybercrimes and 
different motivations of criminals make the phenomenon extremely wide in quantity and 
diversified in forms. The deterrent effect should be achieved by various liabilities. Criminal 
liability being certain (Lehtonen 2000a), the previous research on the liability of cybercrime 
has also focused on justifying the possibility of civil remédiés (Drummond and McClendon 
2001, Bequai 1983, pp. 225-233). 

This chapter will analyse the feasibility of different fonns of possible liability for 
cybercrimes. The feasibility is to be established upon the following considérations, firstly 
concerning the effectiveness of the liability in eliminating the incentives of the potential 
perpetrators as mentioned above and elsewhere by many others. Another considération is that 
of concentrating on the enhancement of the mechanism of traceback as explained in Chapter 4 
Section 4.5. 

10.2 Criminal liability, civil liability and administrative liability 
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In imposing sanctions on cybercrimes, alternative liabilities may be any of the three kinds: 
criminal, civil and administrative liability. Criminal liability is the most common choice; 
importance of civil liability is increasing; while administrative liability has only a limited rôle 
in combating cybercrime. 

The justification for criminal liability must refer to the reasons for imposing a penalty. 
Since Jeremy Bentham,criminal science has been built up on the supposition of crime as 
rational behaviour. People prefer committing crime to behaving legally because the gain from 
illégal activities is bigger than that from legal activities. Becker (1968) developed the theory 
from the viewpoint of the économie analysis of crime. Criminals are supposed not only to be 
rational, but also calculating. Imposition of punishment is to raise the expected costs and 
diminish the expected benefits of crime. When détection counterbalances the benefits, the 
potential perpetrator would give up crime. In order for the punishment to deter crime, severity 
of penalty should be fully taken into account to supplément the insufficient probability of 
détection and conviction (see Becker 1968). 

These deliberations only give half the answer. The fact is that many other criminals are 
hardly rational, and are not really calculating, either. So traditional deterrence can work only 
in the case of rational criminals, but cannot work against irrational criminals. 

Punitive liability is based on the proportionate principle, that is, the penalty should equate 
with the severity of an offence. The complété contents of the proportionate principle include 
the following aspects: that ail offences should be punished, while a non-offence should not be 
punished; a serious offence should be punished with a severe penalty, while a less serious 
offence should be punished with a less severe penalty; accomplices in complicity should be 
punished according to their rôles in the offence. 

It has been assumed that the purposes of imposing criminal liability fall into two 
categories, that of spécial deterrence and that of general deterrence. 284 In the case of 


283 The utilitarian philosopher, holding that pleasure is the chief end of life and that the greatest 
happiness for the greatest number should be the ultimate goal of human beings. 

284 Claimed by Cesare Beccaria in Crimes and Punishment (1764). See, for example, Levinson (2002), 
pp. 512-513, for a detailed introduction. 
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cybercrime, criminal liability is definitely the choice that has priority. 285 The effectiveness of 
deterrence dépends on the severity of punishment and the probability of conviction (Becker 
1968). The probability of détection and conviction is limited by the characteristics of 
cybercrime. It is possible to raise the probability of détection, but it requires an increasing 
investment of both money and human resources on law enforcement (Mennin 1973, pp. 
14-20). Even if investment is increased, the probability of détection cannot be 100 percent. In 
fact, the probability of détection in cybercrime has been very low, due to the preference and 
ability of both criminals and victims to hide their crimes (see Chapter 7, Section 7.8-7.10). 
Another way to increase deterrence, however, is to aggravate punishment. The severity of 
punishment is also subject to limitation by récognition of certain factors, of the seriousness of 
the offence, of humanitarianism, as well as of the cost of punishment, particularly 
imprisonment. Instead of imprisonment, if a substantial sum of a penal fine were imposed, 
and the criminaTs financial situation could not meet the requirement, the actual enforcement 
might be impractical. It is, therefore, difficult to say whether fine could act as a complété 
substitute for imprisonment. In conséquence, it may be argued that, the effectiveness of 
criminal liability is important but limited. At the same time, criminal liability alone does not 
provide any remedy for the victims, who in many cases suffer more or less losses. 

In addition, although criminal law can cover négligent and strict liability, the current laws 
generally criminalize only intentional cybercrimes. While there is a concern about 
undercriminalization, critics hâve also argued that overcriminalization may happen. Besides, 
it is still disputable as to whether their activities should be criminalized. 

It is possible to say that civil liability is a necessary remedy to cover the insufficiency of 
criminal liability, even though it is designed primarily to provide a remedy for the victims. 
Civil liability is not a substitute for criminal punishment. If criminals only bear civil liability, 
the effectiveness of deterrence will mostly be absent. Civil liability thus plays a weaker rôle in 
deterrence than criminal liability. However, it has a strong function in providing a remedy for 
the victims by making the criminals pay. By doing so, civil liability can compensate at least 
for a part of the victims’ losses, and can reduce the gain of the criminal from cybercrime. If 

285 The author wishes to impose a caveat about the view that it is time to abolish punishment and 
prisons as uncivilized. 
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there is a civil liability, potential perpetrators will inevitably consider it more expensive to act 
illegally. Laws in many countries hâve imposed civil liability. For example, the U. K. 
Copyright, Designs and Patents Act 1998 provides civil remedies to compensate victimized 
intellectual property rights holders and for other copyright offences included in Section 107. 
In addition, by holding the third parties liable, civil law in many countries allows a victim to 
recover losses from third parties if their négligent or intentional act has caused the loss 
(Kenneally 2001, p. 63). In cyberspace, third parties may be the only source of recovery. 
The direct effect of third party liability is that it créâtes incentives for the parties to invest in 
maintaining effective security protection. However, as we mentioned above, the deterrence of 
civil liability should not be expected to be too effective. Civil liability is confronted with the 
same problem of the low probability of détection. If the probability is too low, civil liability 
will also be ineffective. 

In order to maximize the effectiveness of the deterrence, criminal liability, civil, and 
administrative liability should be imposed simultaneously. The criminal should be held to be 
liable on ail three grounds. In addition, other individuals and corporations should be held 
liable for relevant behaviour in the same case. These should include personnel in charge of 
management who hâve abused their duties, intermédiares who hâve failed to provide 
reasonable supervision of criminal users and protection for victim users, and manoeuvred 
third parties who hâve failed to protect their own Systems and failed to prevent their Systems 
from being used in attacks against others. 


10.3 Individual liability and corporate liability 

The subjects (perpetrators) of cybercrime can hâve different combining forms: a simple 
individual, several unorganized individuals, several organized individuals, and a corporately 
organized form. When only one individual is involved in the case, liability is limited to this 
person only. When more than one individual are involved in the case, they may form 
conspiracy, gang, or organized crime ring. In traditional criminal-law theory, these 
cybercrimes of different organizing structures may still induce individual liability. However, 
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the liability of each individual may be determined by the rôle that this person has played in 
the illégal activities, including being a principal, aider and abetter, leader, organizer, etc. 

It is possible that cyber conspirators are distributed in different places (cities, provinces 
or countries), and communicate and commit the crime with the help of the Internet. The 
trans-territoriality of this kind of crime makes it complicated to investigate and hold the 
conspirators liable. 

When a great number of individuals commit a crime, the opportunity of impunity 
becomes bigger (Radzinowicz and King 1977, p. 44). Cyber gangsters are not necessarily 
more organized than other conspirators are. However, they may be more widely dispersed and 
operating on a larger scale. Hactivists may be classified into this category. At the same time, 
gangs in the traditional sense can be fonned with the help of the Internet. 286 Pure cyber gangs 
may not only be organized through the network but also commit offences online. 

Organized cybercrime, cyber terrorism, and cyber war are also possible. After the 9/11 
attacks, individuals, organizations and govemments ail over the world became aware of future 
threats in cybersecurity. Brenner (2002) explored the problem of possible influence of 
cyberspace on criminal organizational forms. Many commentators hâve also written and 
reported about cyber terrorism and cyber war. In cyber terrorism, cybercriminal organizations 
should be held liable. In cyber war, even a State may be involved in an international offence 
and be criminally liable. 

Corporations are increasingly the actors in the new social structure (Coleman 1990). 
Individuals are the necessary ingrédients of corporations but corporations are different from 
organized individuals in that the organizing form of the former is subject to a legal character. 
Corporate liability is disputable even in the framework of traditional criminal law. However, 
the tendency is that an increasing number of countries adopt the theory and practice of 
corporate crime. It is natural that corporate cybercrime should also be held liable through 
criminal-law reform in response to the new criminal phenomena. According to the U. S. 
Department of Justice (2003), 287 Article 12 of the Convention on Cybercrime and the 

256 Eastday, Four Liaoning Cyber Friends Allied Robbing Taxi, Killing Driver and Buming Corpse, 18 

March 2006. Retrieved 15 March 2007, from 

http://news.eastday.com/eastday/node79841/node79860/nodel24570/userobjectlail922624.html 

257 U. S. Department of Justice. Frequently Asked Questions and Answers-Council of Europe 
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Explanatory Report paragraphs 124-125 provide that only if a person’s act constitutes an 
offence under traditional principle of corporate liability, may the corporation face criminal, 
civil or administrative liability. Mere users’ actions are excluded firom corporate liability. 
According to the Convention on Cybercrime, corporate liability is established based on the 
individual or organizational activities of a natural person who holds the power of 
représentation of the legal person, who has an authority to take decisions on behalf of the 
legal person, or an authority to exercise control within the legal person. - Upon ratifying the 
Convention, individual countries shall hâve to implement its provisions conceming the 
liability of legal persons for some of the cybercriminal offences originally absent from their 
own national law. 289 Besides Internet service providers, there are many other corporations 
engaged in online activities associated with the relevant obligations. Corporate liability can be 
of a particular severity, for example, in the U. K., corporate criminal liability can resuit in 
penalties on companies and their directors of unrestricted fines and less than two years of 
imprisonment. The same spirit of the law can well be extended to these corporations and 
possibly impose liability on them. Bearing in mind what has been said previously in Chapter 8, 
we now indicate the legal remedy that can be used resolving the underlying problems 
envisaged earlier. We therefore turn to the remedy of liability for damage. 


10.4 Liability based on law and liability based on contract 

Before liability for cybercrime is imposed, law or contract might provide obligation or 
responsibility. The liability cornes from a breach of law or contract in the fonn of the 
commission of a proscribed act or the omission of a prescribed act. 

Law prohibits cybercrime. Committing a cybercrime must induce liability. However, the 
law does not run concurrently with the development of technology. The concem of liability 


Convention on Cybercrime, November 2003. 

288 Council of Europe, Article 12.1, Convention on Cybercrime, Budapest, 23 November 2001. 

289 HE 153/2006, Detailed Justifications, 1. Contents of the Convention and its Relation to Finland’s 
Législation, Part II National Measures. 
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must be widened. According to the principle of legality, the supposed liability does not exist 
in law. Therefore, législation should be the basis for liability. 

On the other hand, a promise can be made in a contract to create obligations. When one 
party breaches the obligation, the aggrieved party may be remedied according to contract law. 
Liability in contract law can create an incentive to maintain a secure critical infrastructure. 
This kind of obligation can be agreed in the contracts between institutional users and service 
providers. 

However, my research found that individual users are generally excluded from the 
mechanisms in which the dominant parties are service providers. For example, many service 
tenns drafted and enacted by online enterprises usually include a unilatéral disclaimer of 
warranties and limitation of their liability. 

The disclaimer of warranties requires users to understand explicitly and agréé to use the 
service at their sole risk. The enterprise expressly disclaims ail warranties of any kind, 
whether express or implied. The enterprise further States that it makes no warranty that the 
service will be uninterrupted, timely, secure or error-free; and any errors in the software will 
be corrected, etc. If users download or obtain by other ways any materials, it is at the users’ 
discrétion and risk. The limitation-of-liability clause claims that the enterprise shall not be 
liable to the users for any direct, indirect, incidental, spécial, consequential or exemplary 
damages; unauthorized access to or alteration of the user’s transmissions or data, etc . 290 The 
basic relationship in these clauses is that service providers make no promise, but make a 
non-promise. Non-promise results in no obligation of warranty. Non-obligation results in no 
liability. 


10.5 Intentional liability, négligent liability and reckless liability 

Current criminal-law countermeasures generally criminalize intentional conducts, 
whether in the domestic législations of various countries or in the Convention on Cybercrime. 


290 See Yahoo!, Terms of Service. Retrieved 15 March 2007, from http://docs.yahoo.com/info/terms/ 
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The Convention requires countries to implement domestic laws to criminalize the following 
unauthorized conducts: 


Intentionally accessing infonnation Systems (illégal access, Article 2), 

Intentionally intercepting infonnation Systems (illégal interception, Article 3), 

Intentionally interfering with data and Systems (data interférence, Article 4, and Systems 
interférence, Article 5), 

Intentionally misusing devices for the purpose of committing any of the offences 
mentioned above (misuse of devices, Article 6), 

Intentionally aiding and abetting the commission of any of the above offences (Article 7). 

The Convention leaves countries to make further requirements or réservations, but the 
subjective aspects are not in the items of the Convention subject to such discrétions. 

If users fail to secure their own infonnation Systems from outside exploitation and cause 
damage to another user, they should be held liable for the négligence and compensate the 
victimized party. The prerequisite for this négligent liability is that users do not take suffïcient 
care to protect reasonably their infonnation Systems. 291 The factors in judging whether users 
are taking reasonable care include the amount of information held; the form in which 
information is retained; the sensitivity of information; the level of risk; the size of the 
company; and the cost of rendering information Systems secure. 292 

Conceming négligent and reckless liability, there are several situations: 

1. Laws specifically exclude négligent liability. For example, in U.S.C. 18 §1030 
prescribes that négligent design or manufacture of computer hardware, computer software, or 
firmware are immune from a civil action to obtain compensatory damages and injunctive 
relief or other équitable relief by any person who suffers damage or loss (The U.S.C. 18 
§1030 (g)). 

2. Laws criminalizing intentional conduct also involve punishment for some kind of 
négligent or reckless misconduct. For example, the Section 151b of the Penal Code of 


291 Bridge Point Communications, Information Security: Corporate and Individual Liability, October 
2001, pp 1-2. Retrieved 15 March 2007, from 

http://www.bridgepoint.com.au/LinkClick.aspx?link=PDF+Docs%2Fliabilitypaper.pdf&tabid=36&mi 
d=376 
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Norway criminalized the act of negligently destroying, damaging, or putting out of action any 
data collection or any installation for some critical sectors, and imposes fines or imprisonment 
for a term not exceeding one year. The Section 250 of the Norwegian Crimes Amendment Act 
2003 prescribes punishment for act of intentionally or recklessly damaging or interfering with 
computer Systems (Section 250). That is to say, the severity of intentional liability and 
reckless liability are treated equally in the offence of damaging or interfering with computer 
Systems. Section 251 also provides the reckless factors in the offence of making, selling, or 
distributing or possessing software for committing a crime, “knowing or being reckless as to 
whether it will be used for the commission of a crime.” (Section 251 (1) (b)) Section 252 (1) 
also prescribes recklessness as a factor in the offence of accessing computer Systems without 
authorization, “every one is fiable to imprisonment...who intentionally accesses, directly or 
indirectly, any computer System without authorization, ...being reckless as to whether or not 
he or she is authorized to access that computer System.” (Section 252 (1)) However, this is 
hardly to say that Sections 251 and 252 establish reckless liability. Similarly, the 18 U.S.C. 
§1030 also includes a clause to penalize recklessly-caused damage, but as a resuit of 
intentional access to a protected computer without authorization (The U.S.C. 18 §1030 (a) (5) 
(A) (ii)). 

3. Législation proposais, such as the model law of the Commonwealth, taken in reckless 
liability. The Commonwealth’s model law has extended criminal liability to the mens rea of 
offences of interfering with data, interfering with computer Systems, and illégal devices so as 
to include reckless liability. 293 The establishment of négligent liability contributes to fonning 
a close legal framework in combating cybercrime through strengthening the security 
consciousness of infonnation-systems users, particularly management. To date, explicit 
négligent liability for cybercrime is still, however, absent from the international instruments 
and laws of most countries. 


293 Legal and Constitutional Affairs Division Commonwealth Secrétariat, Report on Law and 
Technology Workshop for the Caribbean, Kingston, Jamaica, November 3-7, 2003, published in 
January, 2004. 
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10.6 Direct liability and indirect liability 


Direct liability is the liability directly derived from the illégal act that involves 
information Systems. As in the situation where traditional offences are prohibited, the basis 
for cybercrime liability is the same as for the non-cybercrimes. We are not discussing various 
théories about what the basis for criminal law is, nevertheless, cybercrime is no different from 
the older crimes in that old crimes infringe human rights and property rights, and violate the 
social order. Indirect liability is the liability that is derived from the omission of supervision 
and management over the activities of the perpetrator or over information Systems. The 
establishment of obligation is the prerequisite for indirect liability. The effective incentive for 
the responsibility of supervision and management must be ensured by work ethics, rules or 
disciplines, and civil, administrative, or criminal liability. Kelly (2002) analysed the 
institutions’ liability for e-mail in further éducation and higher éducation institutions. He 
pointed out that e-mails may be regarded as published information originating from the 
institution and the liability for its publication may attach to the institution. If the institution is 
held liable, this liability is derived indirectly from the users’ act. 


10.7 Trespasser’s liability, third parties’ liability, and victim’s liability 

Trespassers include a wide range of individuals and corporations: System intruders, virus 
creators and distributors, illégal web site owners and administrators, authors of illégal 
contents, illégal service providers, illégal product traders, and so forth. Trespassers’ liability 
includes criminal liability, civil liability and administrative liability for their cybercriminal 
act. 

Third parties include Internet service providers, security publishers, Internet security 
providers, software vendors, software authors, and System owners. They may also be 
criminally liable, but in most cases, their liability should be to provide civil remédiés for the 
victims. According to the U. S. Department of Justice (2003), 294 the Convention on 

294 U. S. Department of Justice. Frequently Asked Questions and Answers-Council of Europe 
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Cybercrime does not require the service providers to monitor content to avoid liability. The 
provisions of the Convention governing aiding and abetting do not naturally apply to the 
service provider (Article 11, and Explanatory Report paragraph 119). This Convention 
exempts third parties from liability, but is limited to the Internet service provider as far as 
Internet content is concemed. 

Summing-up the discussion of Icove and co-workers (1995), Drummond and 
McClenden (2001), Fisk (2002), and others, about third parties’ liability, covering ISPs, 
security providers, software vendors, software authors, and System owners, the situation is 
that where no liability mechanisms are implemented, they will hâve insufficient incentive to 
provide higher standard of products or services. The following Canadian case proved that the 
absence of liability mechanisms leaves the relevant party unaware of unauthorized access 
concerns. 

“Several participants in online contests run by the company in question received 
téléphoné calls from a person or persons falsely claiming to represent the company. In an 
internai investigation, the company cannot détermine exactly how unauthorized persons had 
obtained personal information collected from contest entrants, but believed it possible that 
the computer database in which information was stored may hâve been compromised. An 
inspection by an outside firm cannot confinn how or even whether the database had been 
compromised, but did give rise to several recommendations towards improving the 
company's informational security. The company has adopted ail recommendations and has 
taken spécifie measures to physically secure contest participants’ personal infonnation from 
unauthorized access. 

At the time of the complaint, the company had no policies for the rétention and disposai 
of personal information. On the advice...the company has also agreed to implement such 
policies.” 295 

The reason for insufficient incentive is mainly that the improvement of quality of 
products or services is costly, requiring more investment of money, time, and human 
resources. Liability mechanisms will create incentives to provide products or services on at 

Convention on Cybercrime, November 2003. 

295 Finding #52, 2002 CanLII 42357 (P.C.C.). 
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least a standard level. Products and services containing security defects are at great risks of 
falling fool of product liability. 

However, holding third parties liable is not without risks, because products and services 
are usually provided subject to contract or licensing agreements, making tort liability 
inappropriate because the parties hâve bargained to allocate the risk between them (Perle and 
co-workers 2000, pp. 10, 12). The reasonable starting-point for concluding agreements is that 
neither of the two parties wants to endure more risk. In general, product or service users may 
hâve greater discrétion in choosing more guarantees and fewer expenses. Third parties will 
generally be worse-off. However, third parties will pass on to the users the extra costs in 
improving the quality and fixing the loopholes. They will raise the prices of their products or 
services to a higher quality level. 

Particularly, there are also some unique aspects of software that make it challenging to 
apply traditional concepts of liability to firee software authors. Free software is also called 
open source software, which is software that must be distributed with a source code included 
or easily available, such as by free download from the Internet (Kavanagh 2004, p. 1). As a 
movement, free software dated from 1984, when Richard Stallman flrst published the idea 
that software should be free “as in speech,” so that users can review it and change it, as he or 
she requires to (Kavanagh 2004, p. 2). The term open source dated from 1997, when Eric 
Raymond, Tim O’Reilley, Bruce Perens and others decided to emphasize the technical and 
practical advantages of open source software to avoid making the idea less attractive to 
businesses (Kavanagh 2004, p. 2). Kavanagh (2004) claimed that open source is successful 
(pp. 19-40), good (pp. 41-52), inadéquate (pp. 52-55), more difficult (pp. 56-62), but he 
mentioned nothing about security. However, the open source licenses usually include a 
disclaimer of warranty or limitation of liability. 296 

The disclaimer of warranty usually reads as the following: 

“...[T]he Original Work is provided under this License on an “AS IS” BASIS and 
WITHOUT WARRANTY, either express or implied, including, without limitation, the 
warranties of non-infringement, merchantability or fïtness for a particular purpose. THE 

296 Kavanagh (2004) listed licenses of GNU General Public License, Mozilla Public License, and The 
BSD License. In fact, many other open source licenses are available from the Internet. 
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ENTIRE RISK AS TO THE QUALITY OF THE ORIGINAL WORK IS WITH YOU.. ,” 297 
The limitation of liability usually includes something of this kind: 

“Under no circumstances and under no legal theory, whether in tort (including 
négligence), contract, or otherwise, shall the Licensor be liable to anyone for any indirect, 
spécial, incidental, or consequential damages of any character arising as a resuit of this 
License or the use of the Original Work including, without limitation, damages for loss of 
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A victim of crime is not always innocent. However, traditional criminal law does not 
impose punishment on a victim. The notion of culpable victim merely means that the victim 
induces the offence against him or her. To impose punishment on victim or on the responsible 
personnel of the victimized institution becomes realistic in white-collar crime and corporate 
crime. In infonnation Systems, victim liability is no longer a taboo. The culpable victim may 
be punished either due to his or her preceding illégal behaviour or due to his or her failure to 
prevent the illégal behaviour. In some spécial cases, laws also impose such a liability on 
victims. As Sadowsky and co-workers (2003, p. 175) hâve pointed out, if a site is made 
inopérable by a déniai of service attack, the company may be liable for daims based on 
breach of contract. Definitely, in this case the victim of the attack also breaches the contract 
and becomes a liable party. However, it is necessary to avoid over-criminalization and 
mis-criminalization. The EU Framework Decision on Attacks against an Infonnation System 
(12 May 2003) recognized the “need to avoid criminalizing the right-holder and authorized 
persons.” (Preamble (13)). 


10.8 Domestic liability, trans-national liability, and international liability 

Some kinds of cybercrimes are usually aimed at domestic targets, though perpetrator and 
victim are not necessarily the same jurisdiction. The general principle of jurisdiction can be 
applied to deal with such cases. Criminal justice assistance is also necessary in investigation 
and prosecution. 

The trans-border nature of the Internet often enables trans-national cybercrimes: an 
offence being canied out from different countries; an offence targeting victims in different 
countries; or an offence targeting a floating victim who travels through States A, B, C, etc. Ail 
these cases are brought about by the trans-border infonnation flow. In the last few years, 
people hâve compared information Systems with a superhighway. Wherever infonnation can 
reach, there infonnation Systems can facilitate cybercrime. Relationships between offenders, 
victims, and intennediaries that link them are ail connected into this System, enjoying the 
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wealth of information and taking potential risks. It is natural that the trans-border liability will 
be prévalent. 

Cybercrime of an international nature, such as cyber terrorism and cyber warfare, is 
comparable to traditional international crimes. Universal jurisdiction should be applied in 
such cases. However, this is still a theoretical supposition. 


10.9 Offensive liability and défensive liability 

Offensive liability is the liability for the offensive act. The person who is liable for his or 
her offensive act is the perpetrator of cybercrime. Défensive liability is the liability for 
omission of the défensive act. Cybercrime does not always resuit in défensive liability. 
However, if there is a legal obligation upon the parties whose Systems are targeted or 
exploited, victimized or exploited parties may also be liable for the omission of an obligation. 
In content-related cybercrimes and denial-of-services attacks, the content-service providers 
and compromised computers are in a défensive status and potential liability falls into the 
context of défensive liability. Traditionally, subjects in a défensive status are only liable when 
there is a legal basis for the logic of “failing to prevent a crime is to cause it,” and where, 
usually, big organizations become significant targets of public complaint about crime 
(Sherman 1995, pp. 102-113). In the network environment, two contrary tendencies exist in 
the meantime. One is the pressure of imposing suitable obligations for the prévention of 
cybercrime in big online enterprises, the other is that these enterprises hâve sufficient power 
to resist this kind of pressure. Therefore, if défensive liability cornes into being some day, it 
would hardly be in a short period of time. 


10.10 Punitive liability, exemplary liability and compensatory liability 


Punitive liability is the liability primarily for punishing the offender and deterring further 
offences. The punishments provided in criminal law, such as imprisonment and fine, are 
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designed to serve this function. Ail of the offences, including cybercrime, are treated similarly 
in criminal law. Although the purpose of modem criminal law is deterrence, the innate nature 
of the penalty is to punish the criminal. This nature has never been changed by the 
development of a set of modemized tenninology in criminal law. The tenninology functions 
mostly in adjusting the principles to changing social needs. Consequently, the punitive nature 
of criminal law has shown a réduction in the severity of its linguistic expressions, and less 
concrète structures. However, when we discuss criminal law, we are straightforwardly 
relating the person to the artiflcial unhappiness of the punishment, which is the conséquence 
of the inhérent liability of committing a crime. 

Exemplary liability is liability for alerting the perpetrator, containing both punishment 
and compensation. Exemplary compensation is a kind of liability that imposes monetary 
damages greater than the actual losses. Due to the low probability of détection of cybercrimes, 
punishment should be severe enough to deter them. The exemplary liability may be a useful 
way of increasing the severity of punishment. The reason why exemplary liability is supposed 
to be effective is that socialized individuals are morally responsible and psychologically 
correctable. Exemplary liability symbolizes cybercrime as a moral wrong and an unfair 
psychological gain. What is a moral wrong should be publicly reprimanded, while deprivation 
should be the fate of what is unfairly gained. Beyond reprimand and deprivation, exemplary 
liability is designed to prevent future wrongdoings. 

Compensatory liability is liability primarily for compensating losses of the victim from 
cybercrime. Compensation is generally meant to match the losses of the victim. Such 
compensation falls into the fîeld of civil liability. Because cybercrime usually causes great 
losses for the victims, the compensation helps the victim to recover the whole or part of the 
losses. The révélation of a personal message or trade secret may be a fa te fui incident for the 
réputation of an individual or business of an enterprise. While compensation for a sum of 
millions of dollars cannot be afforded by most hackers, smaller sums of compensation are 
quite realistic. The necessity and possibility of compensatory liability for some victims of 
cybercrime is justificd as a complementary remedy. 
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10.11 Conclusion 


In the case of cybercrimes, the losses from the criminal action are mainly pecuniary, 
while the damages are non-substantial. In addition, there is usually an involvement of 
multiple parties in the cybercrimes and thus the identification of subjects becomes difficult. 
This nécessitâtes the establishment of a multi-layer liability System of multiple subjects. 
Moreover, the damage from cybercrimes is great, while the détection probability and rate of 
conviction are both low. This demands the imposition of heavier sanctions than in the case of 
crimes with a higher détection probability. 

Liability can only be effective when it discourages criminals, creating an incentive for 
security. If there is no incentive, even if there is liability, there should be no liability, because 
this kind of liability is not cost-effective and inefficient. On the other hand, the establishment 
of liability should be based on creating incentives for the subjects, to prevent those who 
distribute software which is vulnérable to hacking, those who access the Internet with the 
possibility of being exploited by attackers, and those who provide security services that are 
insecure, and so on. 

However, the law should not be there to hold ail those responsible liable when the 
breach of responsibility is expressed in the form of a crime, but to impose liability, as 
necessary, on those whose activities reasonably cause the effect according to strict legal 
principles. The above discussion is to demonstrate the possibility of liability forms rather 
than to create liability for any user of information Systems. 

Liability is not in the air, but on the ground. Liability should be fixed by législation, as 
has been stated in this chapter. However, liability also should be established in jurisdiction, 
as we will see in the next chapter. 
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CHAPTER 11. WEAVING CYBERCRIMINAL JURISDICTION INTO THE LEGAL 


NETWORK 


11.1 Introduction 

Unless jurisdiction can be exercised over cybercrime, no liability can be imposed on the 
perpetrator. Jurisdiction is not a problem emerging only in issues associated with infonnation 
Systems (Westby 2003, p. 41). However, it is becoming significant in the digitalized 
environment. Crime is undergoing a process of globalization (Findlay 1999, Lehtonen 2000b); 
cybercrime particularly is in principle borderless. Smith, Grabosky and Urbas (2004, pp. 
48-49) hâve summarized four challenges that the trans-national dimension of cybercrime 
poses for prosecutors: to establish the criminal jurisdiction of an act in question, to collect 
adéquate evidence to activate the law, to identify the criminal and to décidé his or her physical 
location, and to décidé either local jurisdiction or extradition. 

Actually, many éléments hâve significant functions in deciding which court has power to 
exercise jurisdiction over a criminal case. The Internet poses the great challenge to the 
traditional practice of exercising jurisdiction. The trans-border nature of information Systems 
makes the boundary of criminal jurisdiction more ambiguous. Technically, the perpetrator can 
give a command to a computer in State A to modify data physically stored in a medium 
located in State B, without the knowledge of the actual location of the data. The modified data 
may produce a harmful effect in State B after Crossing communications networks located in 
several other countries. Based on the traditional theory of criminal jurisdiction, many 
countries can claim jurisdiction over the case based on the acts of modifying the data, the 
transmitting of modified data, and the emergence of harmful effects. It is difficult to 
detennine the geographical location and thus the jurisdiction. 

In addition, the uncertainty in cyberspace complicates the traditional criminal 
jurisdiction. In the latter, the nationality of the perpetrator, the location of the act and the 
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effect can be the basis for the criminal jurisdiction because of their link to a substantial 
location of a certain jurisdiction. In cyberspace, however, the link between these factors and 
substantial location becomes uncertain. We cannot find the résidence and tangible property; 
detennine the nationality of the actor, and the exact location of a remote logging on, but only 
the existence of the actor and the detailed contents of the criminal act. In sum, the traditional 
criminal jurisdiction should now be globalized (Berman, 2002). 


11.2 The legal basis for cybercriminal jurisdiction 

Criminal jurisdiction means the power of a State to prosecute and punish the criminal. In 
terms of international law, it is the foundation for dividing the power between countries over a 
criminal justice that involves international factors (Zhao 1994, p. 116). The established 
principles of criminal jurisdiction over international crime include the principle of territorial 
jurisdiction, the principle of personal jurisdiction, the principle of protective jurisdiction, and 
the principle of universal jurisdiction. The former three principles are also effective in 
domestic criminal law, and the last principle is unique in international criminal law. 

“Sovereignty accorded each State suprême, comprehensive and exclusive rule over its 
territorial jurisdiction.” (Linklater 2000, p. 1504) Under this principle, the criminal is subject 
to punishment by the State where the crime was committed, without considering the 
nationality of the criminal (Van Dervort 1998, p. 254). Law shall apply to a crime committed 
in the State where the law is enacted. 299 Vessel and aircraft are generally deemed to be the 
extension of the territory of a sovereign State, whose flag they fly regardless of where the 
vessel or aircraft are located, even if the vessel was on the high seas or in foreign territory, or 
even if in the territory not belonging to any State or the aircraft was in or over such territory. 300 
According to this principle, détermination of the location of cybercrime is the basis on which 
to décidé whether a State has jurisdiction. The act and effect of cybercrime usually involve 


299 See, for example, Penal Code of Finland (39/1889), Chapter 1, Section 1. The English translation 
was made by Ministry of Justice, Finland, as an unofficial translation. 

300 See, for example, ibid, Chapter 1, Section 2. 
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several locations in different States. If every State claims criminal jurisdiction over the same 
offence, jurisdictional conflict is inévitable. 

At the same time, the detennination of the location of cybercrime is more difficult in 
other aspects. The focus of the disputes résolves around the places which can be identifïed as 
the locations of an offence. Traditional theory adopted the places where the act of the offence 
was committed and where the harmful effect of the offence happened. 301 In cybercrime, the 
act can be carried out in a place thousands of kilométrés from the place of its actual effect. 
However, the location where the computer was in operation is publicly regarded as the 
location of the act. What is still disputable is whether the places where the transmitted data 
pass (that is, the networks) and arrive (that is, terminais) and where the web pages are 
deposited (generally, servers) can be regarded as the location of an offence. 

The négative answer to this question was partly given in Directive 95/46/EC, Article 
4.1(c) provides that if “equipment is used only for purpose of transfer through the territory of 
the Community,” national provisions will not be applied. In fact, this provision has almost 
unanimously been provided in the laws of member States. 302 

The principle of nationality is designed to protect the legal rights of domestic or local 
citizens, and prevent an unjust trial of domestic or local citizens by other States or régions: the 
criminal is subject to punishment by the State, to which the criminal’s nationality belongs 
(Van Dervort 1998, p. 261). The principle of active nationality applies to cases in which the 
offenders are citizens of the State, while the principle of passive nationality applies to cases in 
which the victims are citizens of the State . 303 However, because offences covered by this 
principle usually happen outside the State or région, conflicts often appear with the States or 

j01 See for example, ibid, Chapter 1, Section 10, providing that “An offence is deemed to hâve been 
committed both where the criminal act was committed and where the conséquence contained in the 
statutory définition of the offence became apparent. An offence of omission is deemed to hâve been 
committed both where the offender should hâve acted and where the conséquence contained in the 
statutory définition of the offence became apparent.” In the cases of attempt and complicity, the 
location where the offence might hâve been completed or the conséquence might hâve appeared, or the 
conséquence that the offender thought would appear, or the act of complicity might hâve been 
committed, shall apply the Finnish law. 

302 See Danish Act on Processing of Personal Data (Act No. 429 of 31 March 2000), Part 3; Finnish 
Personal data Act (523/1999), Section 4; Icelandic Act on Protection of Individuals with regard to 
Processing of Personal Data, No. 77/2000, Section 6; Norwegian Act of 14 April 2000 No. 31 Relating 
to the Processing of Personal Data (Personal Data Act), Section 4; and Swedish Personal Data Act 
(1998:204), Section 4. 

303 See for example, Penal Code of Finland (39/1889), Chapter 1, Sections 6 and 5. 
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régions which claim jurisdiction according to the principle of territory, and resuit in double 
jeopardy. Finally, this principle is only applied in grave offence, for example, spreading child 
pornography and other illégal information. The principle of nationality is designed to 
supplément the insufifïciency of the principle of territorial jurisdiction but not to impose any 
limit on it. On the contrary, the mere application of the principle of nationality is usually not 
enough for a State to exercise jurisdiction over events in its territory. Sometimes laws provide 
explicit clarification of this situation. For example, Section 9 (1) of the U. K. Computer 
Misuse Act 1990 prescribes that to establish jurisdiction over the offence does not dépend on 
the citizenship of the accused. 

The principle of protection is primarily applied to foreigners or stateless persons who 
commit an offence endangering the state’s interests abroad; the victimized State has the power 
to prosecute or try the case. 304 According to this principle, the State has power to take the 
necessary measures against the offence which breaches the state’s interests. Any online 
activities hâve a global nature, which causes many obstacles to applying the principle of 
protection. On the one hand, the after-effect of cybercrime usually involves many States. If 
every State claims criminal jurisdiction, it will definitely cause a jurisdictional chaos. On the 
other hand, if the cybercrime prescribed in one State is not criminalized in other States, it is 
unreasonable for this State to exercise jurisdiction. No State is likely to exercise jurisdiction 
over cybercrime merely according to the principle of protection. 

The purpose of the principle of universal jurisdiction is the establishment of 
consensus on criminal jurisdiction between States to prevent crime effectively and to combat 
crime under the framework of an international law based on international treaties containing 
penal provisions, and provided by each country’s domestic law. 303 Macedo (2004, p. 9) 
defined the universal jurisdiction as 

304 Zhang (1999), p. 79. For example, the Penal Code of Finland provides that “Finnish law shall apply 
to an offence committed outside of Finland that has been directed at Finland. An offence is deemed to 
hâve been directed at Finland if it is an offence of treason or high treason, if the act has otherwise 
seriously violated or endangered the national, military or économie rights or interests of Finland, or if it 
has been directed at a Finnish authority.” Chapter 1, Section 3. 

305 For example, the Penal Code of Finland provides that “Finnish law shall apply to an offence 
committed outside of Finland where the punishability of the act, regardless of the law of the place of 
commission, is based on an international agreement binding on Finland or on another statute or 
régulation internationally binding on Finland (international offence). Further provisions on the 
application of this section shall be issued by Decree.” Chapter 1, Section 7. 
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“[T]he principle that certain crimes are so heinous, and so universally recognized and 
abhorred, that a State is entitled or even obliged to undertake legal proceedings without 
regard to where the crime was committed or the nationality of the perpetrators or the victims. 
It applies to the most serious crimes under international law: slavery, war crimes, crimes 
against humanity, torture, and some others.” 

Because the criminal act and effect relating to the principle of universal jurisdiction 
usually take place outside the territory of a State, it is by this very nature a matter of a 
trans-territorial jurisdiction. The global nature of online activities facilitâtes a cybercrime 
endangering global targets. However, as to whether the principle of universal jurisdiction can 
be applied to cybercrimes that has a severe impact on global targets, there has not been 
relative agreement. The application of universal criminal jurisdiction is primarily based on 
the nature and gravity of cybercrime. For instance, if there is cyber war crime, piracy, 
terrorism and so forth, the principle of universal jurisdiction should be applied. As with 
traditional international offences, the application of universal jurisdiction over cybercrime 
must be based on explicit provisions in international agreements. Each State cannot apply 
universal jurisdiction merely according to the domestic law (Bossard 1997, p. 111). 

In traditional law, the ownership over land extends to the sky over the land. A state’s 
jurisdiction has the similar pattern, covering surface, underground and airspace, but not outer 
space. 306 At présent, we cannot help asking: does he who owns the soil, own the network? 
However, we hâve seen that individuals and institutions can only own the physical materials 
of the networks, but are not able to control the activities on the networks. Jurisdiction over 
uncontrollable “space” has no realistic basis. Physical and spiritual fences in a traditional 
sense cannot be valid in the networked environment. Furthermore, we must compare offences 
in cyberspace with those in watercrafts and aircrafts, which are called floating territory. A 
State has the power to exercise jurisdiction over offences occurring in watercrafts and 
aircrafts that are registered in the State. Cyberspace is not the same as floating territory in that 
what extends in cyberspace is not the state’s material entity, but is composed of abstract 

306 Outer space refers to the space located outside the Earth’s atmosphère. See Summers (2003), p. 
1168. However, because of its political sensitivity a solution to the defmition/delimitation problem 
cannot be reached on an international level and the issue is still under dispute. See Van Traa Engelman 
(1993), p. 47. 
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information flows, the owners of which are difficult to détermine or are distributed in many 
different territories. The conception of floating territory cannot fonn the basis for jurisdiction. 
Comparable cases also include, for example, the language in which infonnation is compiled. 
If it is the rule that the language, in which an offensive message is written, is the official 
language of a State, which thus has the power to exercise jurisdiction, the situation will 
become even worse. Therefore, both the infonnation flow and language cannot be the basis 
for jurisdiction. Many other nexuses hâve a similar nature. It is advisable for a set of new 
game raies to be implemented in cyberspace. 


11.3 “Separate” or “international” jurisdiction? 

In the mid-1990s when the Internet was opened to access for commercial use and grew 
unprecedentedly, commentators advocated that cyberspace should be treated as a separate 
jurisdiction (For example, Johnson and Post 1996, p. 1367; Oberding and Norderhaug 1996). 
The theory argues that online communities hâve maintained community norms and hâve the 
ability to create and enforce rights and responsibilities (Oberding and Norderhaug 1996). 

In recognizing that cyberspace has its own organizational fonn, value standard, and 
raies, separate from those of the government, and that it maintains its own organs of power, 
the theory advocates that jurisdiction outside cyberspace should be denied. The theory 
emphasizes the novelty and independence of cyberspace, holding a sceptical attitude towards 
the power of real-life States, and worrying that the intervention of State power will hurt the 
freedom of cyberspace. 

Nevertheless, the claim completely confuses two kinds of different powers, specifically, 
the power of ISPs to establish business ethics and technical standards, and the State power to 
enact law and exercise jurisdiction. Although business ethics and technical standard to a 
certain extent may influence law, they can never replace law. Similarly, self-regulation can 
never be a substitute for the public power of law. Cyberspace should not be beyond the 
jurisdiction of the courts, and law should be used to protect the liberal development of 
cyberspace. The fondamental question is how to syncretize the two aspects, and protect the 
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development of cyberspace. 

In order to solve the issue of cyberspace jurisdiction, sonie scholars, represented 
primarily by Darrel Menthe (1998), put forward the theory of a fourth international space, 
which is based on the assumption that cyberspace was a new space, but comparable to the 
mare liberum, outer space and the Antarctica. Based on comparison and analogy, 
Menthe (1998, pp. 101-103) drew the conclusion that cyberspace ought also to accept the 
implicit international customs, that is, the customs similar to those dominating the other three 
international spaces, and thus the problem of judicial jurisdiction would be solved by 
enacting a corresponding regime-specific treaty. He asserted that four international régions 
such as Antarctic, outer space, the high seas, and cyberspace, share the similar characteristics 
of the lack of territorial jurisdiction, and thus nationality is and should be the primary 
principle for establishing jurisdiction (Menthe 1998, p. 70). 

This theory may hâve its advantage in solving the cases involving a single criminal and 
a single victim, or a single criminal and multiple victims. However, there are two points 
requiring spécial considération in dealing with cyberspace. Cyberspace has similarities to the 
three traditional international spaces in that there has not been a unique State endowed with 
complété jurisdiction over these spaces. Nevertheless, cyberspace also has its différences 
firom the traditional international spaces. The status of the traditional international spaces has 
been established by international agreements, while cyberspace is an emerging space without 
a consensus on its status. In cyberspace, there are relevant territorialities located in several 
relevant countries, such as where the nationality of a person or several persons belongs, 
where the web site is registered, where the server is set up or rented, where the victims are 
distributed, and so on. Traditional international spaces are spaces themselves, involving no 
other territoriality. In addition, traditional international spaces are beyond sovereignty, while 

307 The Latin phrase represents “free sea”, a sea open to navigation by ships of ail nations. Dutch jurist 
Hugo Grotius published a treatise “Mare Liberum” in 1609 challenging the right of any nation to claim 
part of the open sea exclusively as its own. The title translates as “The Free Sea”. See McKenna 
(2003b), p. 225. 

308 Territorial claims in Antarctica hâve been made by the United Kingdom in 1908, New Zealand in 
1923, France in 1924, Australia in 1933, Norway in 1939, Chile in 1940, Argentina in 1943 (U. S. 
Congress, Office of Technology Assessment, September 1989, p. 41). The U. S. and Russia hâve made 
no territorial claims and do not recognize the claims of others, though they reserved their rights to 
assert claims in the continent (ibid., p. 43). 
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cyberspace is rooted in sovereignty. The only problem is that juridictions may be extremely 
competing between countries. However, merely to avoid competing jurisdictions should not 
be the ground for establishing nationality as the unique basis for an international rule on 
jurisdiction over cyberspace. At the same time, even if nationality has been established as an 
internationally accepted basis for jurisdiction over cyberspace, the “indefinitely competing 
jurisdictions” cannot yet be avoided, provided that cybercrime is an organized distributed 
déniai of service attack. In cases involving multiple criminals and multiple victims, the 
theory of a fourth international space is completely unadoptable. It is hardly strange that 
these suggestions did not receive any positive reflection from any législature (Zeviar-Geese 
2001; Wober, Frew and Hitz 2002, p. 203). 


11.4 The spécifie space—the détermination of the location of conduct 

Compared with traditional criminal cases, cybercrime cases hâve both a coinmon 
characters and différences that exert an influence on the application of jurisdiction. A number 
of studies hâve been targeted on cyberjurisdiction, either civil, criminal, or comprehensive, 
for example, Biegel (1996), Johnson and Post (1996), Menthe (1998), Post (1996), Jew 
(1999), Zeviar-Geese (2001), Smolen and Downing (2002), August (2002), Brenner and 
Koops (2004), etc. The current situation is more complicated than when the problem flrst 
emerged before the academie vision, with more possible alternatives for answering the 
question. 

According to the traditional theory of criminal law, if either criminal act or harmful 
effect happens on national territory, the crime can be regarded as happening in that country. 
The jurisdiction of the conventional courts is geographically based, with the rule 
incorporating a notion of territoriality (Jew 1999). When this theory was established, the 
early criminal law was rarely confronted with the situation of a geographical séparation of act 
and effect. As we hâve discussed in Chapter 3, Internet communications are geographically 
independent. Information is not limited to one place, but is distributed concurrently globally 
(Police Commissioners’ Conférence Electronic Crime Working Party 2000, pp. 25-28; Rees 
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2000, pp. 16-19). The geographical séparation of act and effect on cybercrime is becoming 
more common. 

There does exist a form coinciding with the traditional criminal act. However, due to the 
spaceless nature of the network environment, attacking targets located in countries other than 
the one where the perpetrators hold the nationality, where they résidé, or where they launch 
the attack, may easily be realized (Smolen and Downing 2002, p. 2). Add furthermore, the 
formation of criminal conspiracy, the transmission of criminal command, the transfer of 
criminal data, and the spread of malicious programmes can ail pass any régions or countries 
that are connected via the Internet. As Lessig (1996, p. 1404) pointed out: online events are 
taking place “everywhere if anywhere, and hence no place in particular.” 

Traditional jurisdiction by territoriality has been determined by the place where the 
offence is committed. The commission place of crime is the basis for detennining whether a 
country holds criminal jurisdiction. We hâve already recognized the universality of 
cybercrime: where there is a computer connected to the networks, there is a possibility of 
being abused. The problem is that millions of computers and more than a billion of Internet 
users form a dynamic space. The borders between abuse and use, defence and offence, 
criminal and victim, are not clearly divided before they are defined within a jurisdiction. 
Computers and networks are value-neutral while users hâve a different value orientation and 
are subject to different legal constraints. When there is no applicable law, there will be no 
différence between crime and innocence. Cyberspace is a territory with law and order over 
which no one single govemment can exercise control, and for which no two governments can 
cooperate. In the traditional mode, an offence has been easily linked to a place. However, in 
the Internet environment, as Lessig said, we can regard a crime scene as: “everywhere if 
anywhere,” where the jurisdiction conflicts are inévitable on the one hand; yet are 
“nowhere,” since the jurisdiction gap exists on the other hand. Therefore, the détermination 
of the location of an act becomes more complex and more costly than ever before. 

The fact is that jurisdiction based on the location of the act is the most convenient way 
for evidence collection. According to traditional criminal law, the location of the act includes 
the location where the act started and where the effect occurs. Any traditional location is 
connected with an address, which is the physical existence of a particular space. An address 
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on the Internet, however, is not the same as that in the traditional sense. For example, an 
e-mail address is possibly “an archive server, a list of people, even someone’s pocket pager,” 
rather than a human being (Kehoe 1993, p. 9). Therefore, there is no address at ail in 
cyberspace. 


11.6 The spécifie player—the détermination of the location of the person 

Internet communications enable people to do far more things than clicking the mouse 
without our physical presence in the place where the effect will happen. The détermination of 
an online user’s location is difficult, if not impossible. Cybercriminals tend to conceal their 
conduct, identity, and location. The complexities of the relationship between offenders and 
victims fonn a more remarkable scénario of international coopération (Smolen and Downing 
2002, pp. 13-14). 

Not in ail cybercrime cases can jurisdiction be determined by the location of the person, 
particularly when the investigator has no way of tracing back to the starting-point of the 
offence when the offender is located in a foreign country that does not hâve a law 
criminalizing cybercrime, or has such a law but without an extradition agreement between the 
two countries. Under such circumstances, the offender has the highest possibility of escaping 
criminal and other liabilities. 

Nationality is not a highly physical way of determining the location of a person. 
Nationality, nevertheless, has a direct link with a country. Traditional jurisdiction by 
nationality relies on the nationality of the criminal or the victim, that is to say, active 
nationality and passive nationality separately. In the Internet environment, both criminals and 
victims involved in a single offence can be multiple and wide distributed. In some 
successfully prosecuted cybercrime cases, nationality has, indeed, been used as the basis for 
jurisdiction. 

One of the examples of active nationality is New York v. World Interactive Gaming 
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Corp., 309 where a New York court denied the claim that the gambling on the Antigua-based 
web site took place in Antigua, where it was lawful, and the court prohibited the New York 
owner from doing business with New York residents. 310 

The typical example of passive nationality is that the State of Minnesota in the U. S. 
seeks to enforce its own domestic législation against out-of-state Internet users (Jew 1999). 
The Minnesota Attorney General fîled a sériés of lawsuits against out-of-state users in 
relation with online conducts that were supposedly damaging to Minnesota residents (Fulford 
1993, Cl). 

Jurisdiction based on passive nationality facilitâtes the jurisdiction based on the location 
where the victimized target is situated. The prerequisites for this jurisdiction are first the 
coordination of the authorities in the location of the act or nationality, and second the 
mechanism of extradition. In United States v. Thomas (1996), Robert Thomas and his wife 
Carleen Thomas in California operated the Amateur Action Computer Bulletin-board System 
(“AABBS”), transferring pornographie pictures to paid users, with advertisements soliciting 
users to purchase videos. “Its features included e-mail, chat lines, public messages, and files 
that members could access, transfer, and download to their own computers and printers.” 311 
Beyond receipt of a complaint about the AABBS from a résident of the Western District of 
Tennessee, Agent David Dinneyer, the U. S. Postal Inspector applied to become a user by 
nickname, and downloaded several “gif” files as evidence. With this evidence, Dinneyer 
indicted the accused for breaching the laws of this State and the U. S. Fédéral Obscenity Law 
in the Tennessee Fédéral Court. The court held that although the accused stored their 
materials in the computer at home, fireely downloaded by the users, and did not breach the 
law of California, these materials were found in Tennessee and the couple were convicted 
according to the laws of Tennessee. 312 

In a broader sense, some newly-developed théories can be regarded as the expansion of 
the nationality principle, such as the theory of server jurisdiction, the theory of the uploader 

309 People of New York v. World Interactive Gaming Corp., 185 Mise. 2d 852, 714 N.Y.S.2d 844 
(N.Y. County Sup. Ct. 1999). 

310 Suprême Court of the State of New York, County of New York: Commercial Part 53, Index No. 
404428/98. 

jU United States v. Thomas (1996 FED App. 0032P (Sixth Circuit)) 

312 


297 




and downloader jurisdiction, both mentioned in Menthe (1998). The theory of server 
jurisdiction has its advantages in identifying the location of the server, that is, the registration 
place. The disadvantage is that the offensive servers may possibly be registered in a country 
where the law legalizes such activities, while the services it provides may be accessed from 
ail over the world. Then the jurisdiction stops at the State boundaries. In the case of a server 
as a criminal target, the principle is essentially a jurisdictional variance by passive nationality. 
The theory of the uploader and downloader jurisdiction is slightly different from a 
jurisdiction by nationality in that if the offender from State A travels to State B and launches 
attacks against the targets in, say, States C, D, E... Then, State A is where she or he holds a 
separate nationality, State B is where she or he commits the offence, and States C, D, E... are 
where the effects of her or his offence take place. Thus, the theory is in fact a variety of 
jurisdiction by passive nationality as well. 


11.6 Liability-based cybercriminal jurisdiction 

The establishment of a nexus for jurisdiction should be based on the existence of 
liability. Jurisdiction over cybercrime should be built on the most direct link with the liable 
subject. The location of the act has most direct link with the perpetrator. Therefore, in most 
situations, jurisdiction is established by the place where the offence is committed, without 
any exception for cybercrime. Although the process of the criminal act may involve different 
locations at the same time or at different stages, there is still a place where the perpetrator 
sends the most direct command, which may be an input from a keyboard, clicked with a 
mouse, both from a fixed tenninal or from a mobile terminal. The location of the tenninal is 
where the criminal most probably appears in person. 

The prerequisite for jurisdiction is the existence of liability. It is liability rather than the 
person or crime that is the basis for jurisdiction. Where there is no liability, there is no 
jurisdiction. When our discussion résolves around jurisdiction, we are in fact caring about the 
power to hold the criminal liable. The above-mentioned function of the most direct link 
indicates that to establish jurisdiction, liability should be identified in the exact location. In 
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traditional criminal-law theory, the principle has already been established that criminal 
liability starts from the beginning of the act, lasts during the process of the offence, and ends 
with the occurring of the effect. If the location where the offence begins, proceeds, and ends 
are different, then the authorities of ail the three locations may hâve jurisdictional power. In 
addition, emphasis on the traditional theory is placed on the location where the act begins and 
ends. 

In cases of cybercrimes, the séparation of the three categories of locations is obviously 
coinmon. However, the most suitable jurisdiction should be established in the locations 
where the act is committed or the effect happens. The locations where the cybercrime may 
“pass by,” but does not hâve an influence on the local interests should not establish 
jurisdiction, because there is no existence of liability in such locations. The claim that a 
server or a web site should be the unique nexus for jurisdiction in cyberspace is not 
acceptable. If there is no liability for breaching local interests, jurisdiction can only be 
established according to the principle of universal jurisdiction. Locations of servers or web 
sites are not necessarily the place where the criminal act begins with a command or ends with 
an effect. They may be a nexus in some cases, but not the only nexus in ail cybercrimes. For 
example, an individual in State A publishes a message on a web page deposited in a server in 
State B in order to defame another individual in State C. The calumniator uses the native 
language that few understand in State B, and few retrieve the massage there. That language 
may be understood in State C where the victim résides. Apparently, State A and State B 
should hold the perpetrator liable, but not State B, which is only a place where the message is 
deposited. However, if the residents in State B can also understand the language of State A, 
the situation will change, because the effect of defamation also happens in State B. Then 
State B can establish jurisdiction, even though neither the criminal nor the victim résides 
there. 

The prerequisite for liability is the existence of both act and actor. Criminal liability 
means that the actor is liable for his or her act. The most convenient situation for exercising 
jurisdiction is that the actor acts in the same place where he or she résides pennanently. We 
suppose once it was unnecessary to distinguish territoriality from nationality. In the 
information âge, what is coinmon is that both the actor and the act are dynamic, and that even 
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the tools of crime are also the wireless and mobile phone. Yet, the actor and his or her act are 
necessarily connected with a certain space. For example, an individual uses a mobile terminal 
in State A to send a command to a fixed terminal located in State B, the terminal in State B 
then transmits the command through several nodes separately in different States before it 
arrives a tenninal in State Z, and the tenninal in State Z makes the last command and 
activâtes hundreds of thousands of terminais located ail over in the world to launch a 
distributed déniai of services attack towards a target in Finland. There is no sense in the node 
States and States where the terminais are located to claiming jurisdiction. However, State A 
and Finland may hâve the better reason to hold the individual liable. 

Jurisdiction is no more than jurisdiction over the person and over the event. It is a 
combination of jurisdiction over a liable person and over a liable event. Nevertheless, it is 
also possible to establish jurisdiction over data packets. When cybercrime involves fraud, 
embezzlement, illégal sales of drugs, weapons, pornography, and the trafficking of persons, 
there must somewhere be a location where the substances and victimized human beings are. 
In addition, supposing that cyber wars or cyber terrorist attacks occur, and the perpetrator has 
breached international criminal law, then universal jurisdiction may play its rôle. Any States 
that hâve joined the agreement should hold the perpetrator liable. In fact, many new théories 
on jurisdiction deal with the locations in which these packets are created, sent, transmitted, 
processed, deposited, or reached. Due to the digital and fluid nature of packets, it is possible, 
but it is unreasonable to establish jurisdiction over the packets as the only nexus which 
proves the perpetrator liable. 

To meet the requirement for protecting the victims, a jurisdiction is also established 
which is focused on the victims. However, it is still jurisdiction over the liable person and 
liable act. It is meaningless to locate the victim merely. Jurisdiction according to passive 
nationality is based on the jurisdiction over the criminal. However, it has more meaning in 
cases of cybercrimes when extraditing multiple criminals to the domestic State of the victim. 
If cybercrime is an organized attack in which criminals are distributed throughout many 
States, and in which victims are also located in many countries, jurisdiction according to 
passive nationality is invalid, and so are jurisdictions according to active nationality and 
territoriality. No old and new theory is suitable for dealing with cases of this kind. States 
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must negotiate to coordinate their actions. Only if universal jurisdiction is available in these 
cases can the States reach a consensus to hold these hackers liable, by prosecuting them in 
one State. 

Wherever the starting-point is, the establishment of jurisdiction should be based on the 
liable person and the liable act. Without these two aspects, there is no liability, and thus no 
necessity for jurisdiction. If the servers, web sites, and even owners of cables are not directly 
involved in the offence, they should be immune from criminal liability. For example, if they 
are abused, exploited, or manoeuvred, they are innocent. Only when they are directly 
involved in the case should they be liable for the offence, for example, only if the web site 
itself is designed to spread malicious programmes should the owner be liable. 

However, the ultimate bearer of liability is the criminal but not the crime. The purpose of 
jurisdiction is to hold the criminal liable. If the link between liability and the bearer of the 
liability cannot be established, jurisdiction is valueless. Those who hâve claimed a separate 
kind of jurisdiction hâve ignored the exact nature of the jurisdiction of criminal justice, that is, 
the power of a State over a criminal for his or her crime. Once the power of the State is denied, 
there will be no jurisdiction. The imagination of changing cyberspace into an independent 
sovereign space has nothing to do with criminal justice. 

In sum, what criminal jurisdiction responds to the question of criminal liability borne by 
the criminal and based on a criminal act. It will be clearer if we take an example from the 
Finnish Penal Code. Chapter 17 Section 16 (563/1998) of the Code provides that organized 
gambling is the act of unlawfully arranging gambling or keeping a room or other premises for 
gambling, or where the proprietor of a hôtel or restaurant establishment allows gambling to 
take place. 313 The establishment of jurisdiction has to satisfy two prerequisites: a space for 
gambling, and “gaines and activities” that can be categorized as gambling. In order to extend 
the validity of this clause to online gambling and establish jurisdiction, a web site has to be 
regarded as a similar place to a room or other premises, while clicking with a computer mouse 

313 Here, “Gambling means pools, bingo, tote and betting games, money and goods lotteries, casino 
operations and other similar games and activities where winning is completely or partially dépendent 
on chance or events beyond the control of the participants in the game or activity and where the 
possible loss is clearly disproportionate to at least one of the participants’ ability to pay up.” Penal 
Code of Finland, Chapter 17, Section 16 (563/1998). 
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in the face of a screen on which “gambling” is taking place should be regarded as the 
équivalent of “gambling.” Finally, organizing gambling in such a place has to be prescribed 
explicitly in the laws or régulations so as to provide the basis for liability and thus the basis 
for jurisdiction. 


11.7 Critical factors in cybercriminal jurisdiction 

After examining most of the plans for jurisdiction over cybercrimes, it is clear that no 
single plan can solve ail the problems. Any plan has both advantages and disadvantages. 
Furthermore, some new plans hâve no practical meaning for the fîeld of criminal justice, but 
only for civil and administrative cases. Although cybercrime is different from traditional 
crimes, it is impossible to abandon completely the traditional criminal-justice System. This 
chapter attempts to collect some factors for a seemingly comprehensive solution to the 
question of jurisdiction over cybercrime. This solution is based on the idea that jurisdiction 
over cybercrime can be flexibly based on traditional jurisdiction, and supplemented by 
jurisdiction over the location of the computer from which the most direct demand was made. 
The aim of the plan is to explore the possibility of solving the question of jurisdiction over 
most cybercrime cases. 

The main issue in a jurisdiction based on the location of the act is that a cybercrime case 
may involve multiple places. It is significant to détermine the place where the computer is 
from which the most direct command was sent, such as the location of the computer from 
which the intrusion command was made, the location of the computer from which the illégal 
contents and viruses were published, and the location of the computer from which the 
command for a distributed denial-of-services attack was made. This is in fact an alternative to 
the jurisdiction based on the location of the act, in which tools of the act are identifiable. 
Generally, this location is most closely linked to the perpetrator, and it is convenient to collect 
evidence and arrest the suspect. But if the victims are concentrated in a certain place, for 
example the attack is targeted at infonnation Systems of a web site, a server, an institution, or 
even a State, the more convenient way is to hold the perpetrators liable at the location where 
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the victims are situated. 


In intrusion cases, there must be a computer used in the offence, or altematively, there 
must be an IP address. Even if the perpetrator uses the dynamic IP address, or conceals the 
real IP address, it is not completely impossible to trace back the real location. 
Notwithstanding this, the process may tum out to be more complicated, and the cost may be 
more expensive. 

In content- or security-related offences, if the owner of the web site, manager, 
administrator, and perpetrator is an identical figure, jurisdiction based on the computer from 
which the direct command was made is possible. If they are different, according to the 
principle of individual liability, it is necessary to find the perpetrator in the location of the 
computer from which the direct command was made. 

In distributed déniai of services attacks, if thousands of computers are manoeuvred so as 
to launch attacks, it is far from easy to détermine the location of the relevant jurisdiction. 
Most of these computers may belong to innocent third parties. Therefore, the location of the 
computer from which the command was sent must be identified. There may be one location or 
more locations subsequently or simultaneously. The principle should be to establish 
jurisdiction through any one of the locations. If the crime is committed by multiple 
perpetrators in many locations, the jurisdiction should once again be coordinated. 

The registration place of a web site can be an alternative to nexus of active nationality, 
that is, the nationality of the corporation. In cases of web sites providing obscene materials, or 
gambling services, jurisdiction established on this basis can avoid the loophole where the 
perpetrator escapes jurisdiction on ground of his personal nationality. If an individual in State 
A registers a web site in State B, and as a resuit the residents in State C are victimized, State B 
should hold the individual liable. In this case, the location of the server is difficult to 
detennine. However, when the substantial location of the web site is where it was registered, 
jurisdiction over this offence should be directed to the registration location. 

It is possible for the perpetrator to escape the law of the State of his nationality, and 
register the web site in a State that does not criminalize the act. In this case, the only feasible 
way is to the coordinate laws between these States. If it is impossible to coordinate laws -as in 
most cases, and the State of registration does not prosecute the case according to its own law, 
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the jurisdiction can also be established according to the passive nationality. 

Whatever the situation, State sovereignty should be respected according to the general 
rule of international law. The problem should only be solved through negotiation. 

In cases of the provision of illégal services, the location of the bank account used to 
receive payment should also be a nexus. The essence of illégal services is to make money, 
while the key step in making the money is to receive the payment. Therefore, the location 
where the payment is received is critical in establishing jurisdiction. Receiving money is a 
part of the criminal act, and has direct link with the perpetrator. Although there is a possibility 
that payment may pass through many countries, the final account must be located in one or 
more spécifie States. Jurisdiction based on these locations is significant. If it is impossible for 
this State to prosecute, it remains feasible to apply the jurisdiction of passive nationality. 

In the case of online sales of goods, jurisdiction should be based on the nexus of location 
where the controlled articles are situated. In the online transaction of legal goods, there is a 
deposit location and a consignment location, usually involving individuals who are directly 
responsible for the transaction. If other liable persons are traceable, the case can be 
investigated or prosecuted by the authorities of the State where the act has been committed or 
the State of nationality. If they are not traceable, the individuals directly involved in the 
consignment of the goods should be investigated so as to find more dues. The goods should 
also be sealed and distrained. If this State cannot investigate on grounds its own law, 
jurisdiction according to the passive nationality or protection jurisdiction should be applied. 

In cyber terrorist cases and other crimes prescribed in international law, the 
establishment of universal jurisdiction is inévitable. A kind of super-national jurisdiction is 
also possible where dual criminality is not the prerequisite as in traditional criminal law. 
Regionally, the Convention on Cybercrime requires member parties to establish a jurisdiction 
sufficient to hold most of the offenders liable for their activities which are prohibited by the 
Convention. A similar treaty is the UN Convention against Trans-national Organized Crime, 
which offers great potential for enhanced coopération among countries with respect to the 
implémentation of anti-money laundering measures inevitably related to the abuse of 
computer networks. 
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11.8 Conclusion 


Because of the wide existence of cybercriminals and the lack of legal consensus, 
cyberjurisdiction is becoming a problem that législation and law enforcement must face. The 
challenge is to create rules that work smoothly across local, national, and international 
boundaries. 

In order to rebuild the basis for jurisdiction, countries hâve passed laws or make 
precedents to cover cybercrime under domestic power. As far as the expanding of the 
principle of territorial jurisdiction is concerned, theoretical and practical efforts hâve been 
made to create new jurisdictional links between the power of the authorities and the events. 
The dissertation évaluâtes the theory of web site locus jurisdiction and the theory of the 
limited expansion of the principle of territorial jurisdiction. On the other hand, signifîcant 
efforts hâve also been made to establish new jurisdictional principles, including theory of the 
new sovereignty, and the theory of international space. 

However, ail these efforts are limited in the scope of their application. A comprehensive 
considération of factors needed for solving the issue of jurisdiction over cybercrime is 
discussed in this chapter, with the purpose for establishing the grounds for a jurisdiction 
based mainly on traditional criminal-law theory and according to different situations in 
cybercrime cases. Practically speaking, traditional legal framework may hâve the potential to 
extend its domain to cyberspace with respect to jurisdiction. For example, the Penal Code of 
Finland prescribes that where “there is no certainty of the place of commission, but there is a 
justified reason to believe that the offence was committed in the territory of Finland, it is 
deemed to hâve been committed in Finland.” 314 

In shifting the emphasis of jurisdiction over cyberspace from a territoriality-dependent 
crime scene to a territoriality independent crime scene, a comprehensive scheme should be 
drawn up to reach full coverage of the complicated situations. Successful trans-border 
prosecutions hâve proved that law enforcement is not without resources when there is an 
urgent call for international assistance, regardless of State boundaries. One of the more 

314 Penal Code of Finland (39/1889), Chapter 1, Section 10 (4). 
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striking examples is the Operation Predator operation. Since 9 July 2003, the U. S. 
Immigration and Customs Enforcement (ICE) hâve launched the Operation Predator 
programme to investigate paedophiles, human traffickers, international sex tourists, and 
individuals who trade in child pornography. The achievements of the ICE hâve been 
approxhnately 7,000 arrests of individuals in the U. S. and 13 other countries as a resuit of 
information provided by the ICE itself. 315 

Jurisdiction is not the only factor, but it is the most important one necessitating 
international coopération. However, one of the prior premises for the resolution of the 
jurisdictional problem is the harmonization of substantive law. The next chapter will give a 
brief sketch of the international efforts to harmonize cybercrime law. 


315 U. S. Immigration and Customs Enforcement, Austrian Authorities Act on ICE Leads; Exécuté 120 
Search Warrants in Massive Child Pornography Probe, 13 June 2005. Retrieved 15 March 2007, from 
http://usinfo.state.gov/gi/Archive/2005/Jun/14-475154.html 
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CHAPTER 12. INTERNATIONAL ACTIONS: HARMONIZING LEGAL SYSTEMS 


IN THE NE TW ORKED CRIME SCENE 


12.1 Introduction 

Traditionally, crime and punishment are largely local, régional, or national. Today, many 
différences confronting us are associated with the transnational character of cybercrimes. It is 
therefore important to hâve international legal instruments ready to serve anti-crime efforts. 

This chapter looks at international harmonizing efforts to fortify the legal battle against 
cybercrime, categorizing the actions into four aspects: professional law-enforcement efforts, 
régional efforts, multi-national efforts, and global international efforts. Subsequently, the 
chapter also categorizes the international actions according to the subject-matters into 
additional aspects, including the promotion of security awareness at both international and 
national levels, the harmonization of législation, coordination and coopération between 
law-enforcement agencies, and direct anti-cybercrime actions. The chapter will also examine 
the nations’ attitudes toward the Convention on Cybercrime. Based on the analysis, the 
chapter will briefly evaluate the effectiveness of previous attempt at international 
hannonization. 


12.2 From domestic législation to international harmonization 

As we hâve seen in Chapter 11, people usually are impressed by the illusory overlap 
between Internet space and international space. Notwithstanding the fact that information 
Systems are linking continents, islands, residents and communities into a giant Virtual 
network, States and areas preserve their traditional sovereignty. McConnell IntemationaTs 
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12.3 Professional efforts of the International Criminal Police Organization 


(Interpol) 


Many international organizations qualify for professional organizations, because their 
goals and activities are focused on certain spécifie issues; these organizations include Interpol, 
the International Télécommunications Union, etc. However, professional efforts here 
primarily mean substantial actions in the fïeld of cybersecurity protection and cybercrime 
prévention. Although some other organizations also greatly contribute to coordinating 
cybersecurity protection, their emphasis is not necessarily on the law. By this standard, this 
section only analyses the actions of the International Criminal Police Organization 
(Interpol). 316 

As an international law-enforcement organization with 184 members, Interpol started 
to tackle computer crime very early, coordinating law-enforcement agencies and législations, 
in regard to which Interpol made efforts to improve counter-cybercrime capacity at the 
international level. A 1981 survey of members on cybercriminal law recognized dilemmas in 
application of existing législation (Schjolberg 2004). Based on the récognition of the legal 
gaps between countries, and gaps between the legal framework and criminal phenomena, 
Interpol expanded its task to both law enforcement and legal harmonization. 

Currently, there are four working parties within the framework of Interpol, comprising 
African, American, Asia-South Pacific and European Working Parties on Information 
Technology Crime. Besides these groups, a Steering Committee for Information Technology 
Crime was established in order to harmonize the different régional working-party 
initiatives. 317 Considering the already-harmonized législation as the prerequisite for the 
coordinated law enforcement, the African Working Party agreed upon “the project on 
législation and comparative law existing in the Africa with a view to having more African 
States co-signing and/or ratifying the Council of Europe Cybercrime Convention.” 318 


316 For a general analysis of Interpol as “a world crime-fighting organization that has puzzled three 

générations of scholars, law-enforcement officers, and législations,” see Fooner (1989). 

j17 See Interpol web site for detailed introduction to the fonctions and activities of these working 

parties and the steering committee, at 

http://www.interpol.net/Public/TechnologyCrime/WorkingParties/Default.asp 
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Compared with the situation mentioned in the conclusion of Chapter 8 (see Section 8.5), this 
is a distinct step forward. Apparently, legal harmonization is one of Interpol’s important tasks 
in working towards an effective law-enforcement environment. 

In regard to law enforcement, Interpol has provided a technical guidance in cybercrime 
détection, investigation and evidence collection. The Interpol Information Technology Crime 
Investigation Manual was compiled by the European Working Party on Information 
Technology Crime. Compared with the substantive and procédural law harmonization of 
today’s Convention on Cybercrime, the Manual developed a technological law-enforcement 
model to improve the effïciency of combating cybercrime. 

Along with efforts in law enforcement on cybercrime, Interpol also takes distinct actions 
to prevent cybercrime, cooperating with credit-card companies to combat payment fraud by 
building a database on Interpol’s web site (Police Commissioners’ Conférence Electronic 
Crime Working Party 2000, p. 64). As one of the necessary coopération projects at the 
international level of law-enforcement, cybercrime and other trans-border crimes are 
specially dealt with by Interpol in gathering and sharing information. In addition, Interpol is 
making efforts to establish a network to for harvesting information relating to activities on 
the Internet. 320 


12.4 Régional efforts 

There are many régional international organizations, with a narrow or broad coverage of 
States, more or less making efforts to maintain cybersecurity and harmonize international 
measures to combat cybercrime. This section will introduce only four of these organizations, 
which hâve taken typical actions in combating cybercrime. 

(i) The Asia-Pacific Economie Coopération (APEC) 

In the Asia-Pacific région, APEC coordinates its 21 member économies to promote 
cybersecurity and to tackle the risks brought about by cybercrime (APEC 2003). APEC has 


320 Interpol, Interpol press release, CPN02/00/COMandPR, 5 February 2001. 
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conducted a capacity-building project on cybercrime for member économies in relation to 
legal structures and investigative abilities, where the advanced APEC économies support 
other member-economies in training legislative and investigative personnel. 321 

After the 9/11 attacks on the U. S., the APEC Leaders issued a Statement on 
Counter-Terrorism, condemning terrorist attacks and considering it urgent to reinforce 
collaboration at different layers to fïght against terrorism. The Leaders called for reinforcing 

322 

APEC activities to protect critical infrastructure. 

The Télécommunications and Infonnation Ministers of the APEC économies issued the 
Statement on the Security of Information and Communications Infrastructures and a 
Programme of Action in 2002, 323 supporting measures taken by members to fïght against 
misuse of infonnation. The Senior Officiais’ Meeting has made a recommendation which 
désignâtes six areas that can serve as the foundation for APEC’s endeavour for cybercrime 
prévention, comprising legal development, infonnation sharing and coopération, security and 
technical guidelines, public awareness, training and éducation, and wireless security. 324 The 
Ministers and Leaders of APEC hâve made a commitment to “endeavour to enact a 
comprehensive set of laws relating to cybersecurity and cybercrime that are consistent with 
the provisions of international legal instruments, including the UN General Assembly 
Resolution 55/63 and Convention on Cybercrime by October 2003.” 325 

In response to this call from the leaders, a survey of laws was carried out and a summary 
was made of the responses from member économies received in 2003 (See E-Security Task 
Group 2003). The économies proposed corresponding projects in infonnation-security task 
groups. For example, the U. S. proposed a project in the e-Security Task Group of the 
Télécommunications and Information Working Group. The fïrst phase of this project was a 
meeting of cybercrime experts from around the région. The meeting was held from 21-25 

321 Cybercrime Expert Group, Proposai, Doc no: telwg29/ESTC/12, APEC Télécommunications and 
Information Working Group, 29 th Meeting, 21-26 Mardi 2004, Hong Kong, China. 

’ 22 APEC Leaders Statement on Counter-terrorism, APEC Economie Leaders’ Meeting, Shanghai, 21 
October 2001. 

323 APEC, Recommendation by the APEC Télécommunications and Information Working Group 
(TEL) to APEC Senior Officiais (SOM) for an APEC Cybersecurity Strategy, 2002/CSOM/052, 
Concluding Senior Officiais Meeting, Los Cabos, B.C.S., Mexico, 21-22 October, 2002. 

324 ibid. 

325 Cybercrime Expert Group, Proposai, Doc no: telwg29/ESTC/12, APEC Télécommunications and 
Information Working Group, 29th Meeting, Hong Kong, China, 21-26 March 2004. 
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July, 2003 in Bangkok, Thailand, and was attended by over 120 delegates from 17 économies. 
The objectives of the meeting were to assist the économies to develop the necessary legal 
frameworks; to promote the development of law-enforcement capacity; and to strengthen 
coopération between private and public sectors in addressing the threat of cybercrime. 326 In 
the conférence, the experts présent agreed that every economy needed a legal framework 
including one for substantive and procédural law, and for the law and policies of 
inter-economies coopération. They confïrmed the rôle of international instruments, 
particularly the Convention on Cybercrime. They also emphasized jurisdictional coopération, 
law-enforcement construction, and the capacity building of the investigators. 327 

In 2005, The sixth APEC Ministerial Meeting on the Télécommunications and 
Infonnation Industry passed the Lima Déclaration, “encouraging ail économies to study the 
Convention on Cybercrime (2001) and to endeavour to enact a comprehensive set of laws 
relating to cybersecurity and cybercrime that are consistent with international legal 
instruments, including UN General Assembly Resolution 55/63 (2000) and the Convention 
on Cybercrime (2001).” 328 However, due to the great différence between member économies 
within APEC, the development toward unified legal instruments has not been too satisfactory. 
Although some économies hâve claimed that their laws hâve been completely consistent with 
the Convention, and some other économies were taking actions to implement provisions 
similar to the Convention, many other countries hâve quite different legal Systems or hâve no 
law criminalizing cybercrime. 

Efforts are still to be made in the forum of APEC to address cybercrime. The U.S. 
proposed the Judge and Prosecutor Cybercrime Capacity Building Project in 2006 in order to 
develop a curriculum devised by government and private sector experts; to translate the 
curriculum into domestic languages; and to train the trainer (judges and prosecutors). 329 


326 See APEC, Cyber Security Workshop Summary, 2003/SOMIII/ECSG/021, Electronic Commerce 
Steering Group Meeting Phuket, Thailand 15-16 August 2003. 

’ 27 APEC, Conférence on the Strengthening International Law-enforcement Coopération to 
Prosecute Cyber Criminals, Hackers, and Virus Authors, Media Release, Bangkok, 25 July 2003. 

328 Article 26 of Lima déclaration, The 6th APEC Ministerial Meeting on the Télécommunications and 
Information Industry (TELMING, 1-3 June, 2005, Lima, Peru). 

j29 APEC, 2006 Budget - Operational Account Project: TEL 04/2006 - Judge and Prosecutor 
Cybercrime Capacity Building Project, 2006/BMC1/012-6, Budget and Management Committee 
Meeting I, APEC Secrétariat, Singapore, 29-30 Mardi 2006 
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(ii) The Council of Europe (CoE) 

The Council of Europe has been working to tackle rising international anxiety over the 
risks brought about by the automatic processing of personal data since the early 1980s. 330 In 
1981, the Council of Europe implemented the Convention for the Protection of Individuals 
with Regard to Automatic Processing of Personal Data, 331 which was revised according to 
the Amendment to Convention ETS No. 108 Allowing the European Community to Accédé, 
15 June 1999, and the Additional Protocol to Convention ETS No. 108 on Supervisory 
Authorities and Trans-border Data Flows, 8 June 2000. The Convention recognized the 
desirability “to extend the safeguards for everyone’s rights and fundamental freedoms, and in 
particular the right to the respect for privacy, taking account of the increasing flow across 
frontiers of personal data undergoing automatic processing,” and the necessity “to reconcile 
the fundamental values of the respect to privacy and the free flow of information between 
peoples” (Preamble). The Convention covers the protection of personal data in both the 
public and private sectors. 

Chapter II of the Convention established basic principles for data protection, one of 
which is data security (Article 7), covering the prohibition of accidentai or unauthorized 
access, alteration and dissémination. 

The expert committee appointed in 1985 published Recommendations of 1989 and 1995, 
addressing the issues of substantive laws and procédural law in this area respectively. 332 

Recommendation R. No. (89) 9 recognized the importance of an adéquate and quick 
response to the new challenge of computer-related crime, which often has a trans-border 
character, and recommended the governments to consider the Report on Computer-Related 
Crime drawn up by the European Committee on Crime Problems. 

Then there is Recommendation No. (95) 13 Conceming Problems of Criminal Procedure 
Law Connected with Information Technology. The Recommendation recognized that 
information Systems may also be used for committing criminal offences, evidence of criminal 

330 For example, on 13 September 1989, the Committee of Ministers of the Council of Europe adopted 
Recommendation R (89) 9 of the Council of Europe on Computer-Related Crime, which contained 
guidelines for national législatures. 

331 ETS No. 108, 26 January 1981. 

332 See Recommendation No. R. (95) 13. 
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offences may be stored and transferred by these Systems, while the criminal procedure law of 
member States often do not provide for appropriate powers to search and collect evidence in 
these Systems during a criminal investigation. The appendix to the Recommendation lays 
down the principles for criminal procedure laws on search and seize, technical surveillance, 
obligations to co-operate with the investigating authorities, electronic evidence, use of 
encryption in research, statistics and training, and international coopération. 

In 1997, the Council of Europe began drafting the Convention on Cybercrime, which 
was open for signature in 2001 and took effect in 20 04. 333 In 2003, the Additional Protocol 
to the Convention on Cybercrime Concerning the Criminalization of Acts of a Racist and 
Xénophobie Nature Committed Through Computer System (ETS NO. 189) was implemented. 
The Convention addresses substantive law, procédural law, jurisdiction, and international law 
in the field of cybercrime. The Convention is a historié landmark in the combat against 
cybercrime. It is expected that the Convention will hâve a deep impact on the legal reform 
relating to cybercrime in its 46 member States and one candidate State. The detailed analysis 
on this Convention will be dealt with in infra Section 12.8. 

In the 2004 Conférence on Cybercrime, the Council of Europe called for “wide and 
rapid” access to and “effective implémentation” of the Convention on Cybercrime, raising 
awareness in the highest political level, and encouraging coopération between public and 

• 335 

pnvate sectors. 

On the 2005 Conférence on Cybercrime, the Council of Europe expressed concern about 
the fast-increasing threats and serious social and économie results of cybercrime including 
terrorist activity on the Internet, noting that most cybercrime is international cybercrime, 
recognized the need for effective and compatible laws and tools to enable efficient 
coopération to combat cybercrime, calling upon public and private coopération, and 
encouraging access to the Convention on Cybercrime. 336 

In 2006, the Council of Europe launched a Project against Cybercrime, intended to 


333 See Council of Europe, Convention on Cybercrime, CETS No. 185, status as of 20 Mardi, 2006. 

334 For more detailed discussion. See infra Section 6. 

335 Council of Europe, Conférence on The Challenge of Cybercrime, 15-17 September 2004, Palais de 
l'Europe, Strasbourg, France. 

336 Council of Europe, Cybercrime: A Global Challenge, A Global Response, Casa de America, 
Madrid, Spain, 12-13 December 2005, CYB (2005) Conclusions. 
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grant assistance to the development of national législation in line with the provision of the 
Convention, training of judges, prosecutors and law-enforcement officers, and training of 
criminal justice officiais and 24/5 contact points in international coopération. 

(iii) The European Union 

The EU took a sériés of actions to tackle cybercrime through impelling a coordinated 
law enforcement and legal hannonization policy. Civil liberty has also been a focus in the 
anti-cybercrime fleld. 

In 1995, the European Parliament and the Council endorsed Directive 95/46/EC of 24 
October 1995 on the protection of Individuals with regard to the Processing of Personal Data 
and on the Movement of Such Data. Section VIII of the Directive specifically deals with 
confidentiality and security of processing of personal data. The Directive applied to 
protection of natural persons (Article 2(a)). The scope of the Directive was limited to the 
processing of personal data entirely or partially by automatic means (Article 3-1). The 
Directive required that appropriate technical and organizational measures hâve to be 
implemented to protect personal data against illégal destruction, alteration, access and other 
illégal forms of processing (Article 17-1). 

The Directive required the Member States to provide administrative and judicial 
remedies for the victim (Article 22), and provided for the compensation liability of (Article 
23) and sanctions on (Article 24) the transgressor. 

In 1997, the European Parliament and the Council endorsed Directive 97/66/EC of 15 
December 1997 concerning the Processing of Personal Data and the Protection of Privacy in 
the Télécommunications Sector. The Directive was aimed at furthering the protection 
implemented in Directive 95/46/EC, and providing for the hannonization of the Member 
States’ provision to attain an équivalent level of protection (Article 1-1). The Directive 
extended the protection of legitimate interests to legal persons (Article 1-2). 

The application scope of the Directive was limited to the processing of personal data 
relating to the provision of publicly available télécommunications services in the public 
télécommunications networks; particularly via the ISDN (Integrated Services Digital 
Network), and public digital mobile networks (Article 3-1). As the Directive 95/46/EC is 
concerned with automatic processing Systems, Directive 97/66/EC has emphasized the 
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linkage with the télécommunications network. The Directive provides requirements directly 
targeted at the service providers (but not member States) “to take appropriate technical and 
organizational measures to safeguard the security of its services.” (Article 4-1). The Directive 
requires the Member States to implement the régulations ensuring the confidentiality of 
communications, prohibiting listening, tapping, storage or other kinds of interception or 
surveillance of communications by unauthorized natural and legal persons (Article 5). The 
Directive limited unsolicited communications (Article 12), which covers automatic calling 
Systems or facsimile machines, but not e-mails. 

On 27 November 2001, a plenary session took place in Brussels of the EU Forum on 
Cybercrime, organized by the EC, 337 and where the primary discussion was about the 
rétention of Ira flic data (EU Forum on Cybercrime 2001). 

In April 2002, the Commission of the European Communities presented a Proposai for a 
Council Framework Decision on Attacks against information Systems, and this proposai 
constitutes the case of the Decision of 24 February 20 05. 338 The Framework Decision 
criminalized the offences of illégal access to information Systems (Article 2), illégal System 
interférence (Article 3), illégal data interférence (Article 4), and instigation, aiding and 
abetting of these offences or attempt at them (Article 5). The Framework Decision only dealt 
with attacks through unauthorized access to or interférence with infonnation Systems or data. 
According to the Decision, illégal access can only be constituted when the illégal activities 
are targeted intentionally against an “information System with spécifie protection measures in 
place and [the attacks] must be for économie gain.” (Article 2) 

The Commission further considered the future possibility of “spécifie protection 
measures” (Proposai for a Council Framework Decision on Attacks against information 
Systems) to broadband networks, saying that, “it is necessary that criminal law covers 
unauthorized access to their Systems even though there may not be adéquate technical 
protection for their Systems.” (ibid.) Thus, conceming the interférence with information 
Systems, it is constituted by serious “hindering” or “interrupting” of the functioning of 

j37 European Commission, EU Forum on Cybercrime, Plenary session, Brussels, November 27, 2001. 
338 Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information 
Systems, Official Journal L 069, 16/03/2005 P. 0067 - 0071. 
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information Systems by “inputting, transmitting, damaging, deleting, deteriorating, altering, 
suppressing or rendering inaccessible computer data” (Article 3). 

This Framework Decision does not specifÿ penalties for illégal access to information 
Systems and instigation, aiding and abetting and attempting of these offences, but requires 
member States to take the necessary measures to ensure that they are punishable by effective, 
proportional and dissuasive criminal penalties (Framework Decision, Article 6.1). The 
Decision spécifiés the penalties for illégal System interférence and illégal data interférence as 
punishable by criminal penalties to a maximum of at least one to three years of imprisonment 
(Article 6.2). As for the “aggravating circumstances”, the criminal draws a maximum of at 
least two to five years imprisonment (Article 7.1). These aggravating circumstances include 
an organized attack, and an attack that has “caused serious damages or has affected essential 
interests” (Article 7.2). Criminal organization is defined as a “structured association, 
established over a period of time, of two or more persons, acting in a concerted manner with 
a view to committing offences.” 339 

It is worth noting that the matters mentioned in the Framework Decision can also be 
found in the Convention on Cybercrime. 340 After révision of the législation required by the 
Convention, the national law (of Finland) will also meet the demand of the Framework 
Decision. 341 Today, comprised of 27 member States and three candidate countries, the EU 
remains active in addressing cybercrime. 

(iv) The Organization of American States (OAS) 

As other régional organizations, the Organization of American States (OAS) with 35 
member States is also highly concerned about the issue of cybercrime. Through its forum for 
the Ministers of Justice or of the Ministers or Attorneys General of the Americas (REMJA), 
the OAS has long recognized the central rôle that a sound legal framework plays in 
combating cybercrime and protecting the Internet. Such récognition has prompted the 
REMJA to recommend the création of the Group of Governmental Experts on Cybercrime 


339 Article 1, Joint Action 98/733/JHA of 21 December, 1998 adopted by the Council on the Basis of 
Article K.3 of the Treaty on European Union, Official Journal L 351, 29 December, 1998. 

340 HE 153/2006, Detailed Justifications, 2. Framework Decision and Valid Législation. 
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(The Group of Experts) in March 1999. 342 The Group of Experts has been devoted to 
analysing cybercrimes, to inspecting the domestic cybercrime law, and to finding ways of 
cooperating in the Inter-American System of combating cybercrime. The Group of Experts 
has held four meetings. 343 

The Meeting of the Ministers of Justice or of the Ministers or Attorneys General of the 
Americas (REMJA III) 344 has urged member States to take steps to endorse cybercrime law; 
hannonize cybercrime laws to make international coopération possible. The Meeting of the 
Ministers of Justice or of the Ministers or Attorneys General of the Americas (REMJA V) 345 
has recommended that member States evaluate the advisability of implementing the principles 
of the Convention on Cybercrime, and consider the possibility of acceding to that 
Convention. 

In 2004, the Fourth Plenary Session of the Organization of American States General 
Assembly passed the resolution on “Adoption of a Comprehensive Inter-American Strategy 
to Combat Threats to Cybersecurity: A Multidimensional and Multidisciplinary Approach to 
Creating a Culture of Cybersecurity, ” proposing that “An effective cybersecurity strategy 
must recognize that the security of the network of information Systems that comprise the 
Internet requires a partnership between government and industry.” 346 


12.5 Multi-national efforts 


Unlike professional organizations that are limited to a more spécifie field of concern, and 
unlike régional organizations that are limited to a more spécifie location of States, the 


~ 42 Meeting of Ministers of Justice or of Ministers or Attorneys General of the Americas (REMJA II), 
Chapter V. 

343 The First Meeting and Second Meeting were held in May and October 1999, separately, the Third 
Meeting in June 2003, the Fourth Meeting in February 2006, ail in Washington D. C. U. S. See OAS 
web site, at http://www.oas.org/juridico/english/cyber_experts.htm 

344 Meeting of Ministers of Justice or of Ministers or Attorneys General of the Americas (REMJA III), 
Chapter IV. 

345 Meeting of Ministers of Justice or of Ministers or Attorneys General of the Americas (REMJA V), 
Appendix I. 

346 AG/RES. 2040 (XXXIV-O/04), Adopted at the fourth plenary session of the Organization of 
American States General Assembly held on 8 June 2004 in Quito, Ecuador. 
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multi-national international organizations care for affairs of a broader range and take actions 
in a broader territorial environment. This section recounts the efforts of three of the 
multi-national organizations. 

(i) The Commonwealth of Nations 

The Commonwealth of Nations took a direct and timely action in the hannonizing laws 
of its member States. In October 2002, the Commonwealth Secrétariat prepared the “Model 
Law on Computer and Computer Related Crime” (Boume 2002, p. 17). Within the 
Commonwealth’s 53 member countries, the “Model Law” has had a wide influence on 
domestic législation. Through this model law, the Convention on Cybercrime has become one 
of the legislative choices in substantive criminal law, covering the offences of illégal access, 
interfering with data, interfering with computer Systems, illégal interception of data, illégal 
data, and child pornography. 

Compared with the Convention on Cybercrime, the Model Law expanded criminal 
liability -so as to include reckless liability- for the offences of interfering with data, 
interfering with computer Systems, and using illégal devices. The Model Law also covered 
the problem of dual criminality by stating that the act applied to an act done or an omission 
made by a national of a State outside its territory, if the person’s conduct would also 
constitute an offence under a law of the country where the offence was committed. This may 
lead to prosecution or extradition based on dual criminality, but not extradition as it is 
provided in the Convention on Cybercrime. 347 

Some of the member countries of the Commonwealth hâve made efforts to draft 
domestic law according to the model law, such as Bahamas and St. Lucia. 348 In Barbados, 
Belize, and Guyana, the Model Law is being considered as a guide to the enactment of 
similar législation. 349 However, in many other countries of the Commonwealth, there is still 
no spécial législation for cybercrime. 350 

Besides impelling législation within the forum, another focus of the Commonwealth is 


347 


Legal and Constitutional Affairs Division Commonwealth Secrétariat, Report on Law and 
Technology Workshop for the Caribbean, Kingston, Jamaica, 3-7 November, 2003, published in 
January, 2004. 
ibid. 


348 


349 

350 


ibid. 
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on mutual assistance in law enforcement between Commonwealth member States and 
between Commonwealth member States and non-Commonwealth States. In the 2005 Meeting 
of Commonwealth Law Ministers and Senior Officiais, the Expert Working Group proposed 
10 recommendations for member States to adopt suitable measures for improving domestic 
law enforcement and trans-national assistance, and encouraged member States to sign, ratifÿ, 
accédé to and implement the Convention on Cybercrime as a basis for mutual legal assistance 
between Commonwealth member States and non-Commonwealth States. 351 
(ii) The Group of Eight (G8) 

Since the mid- 1990s, the Group of Eight (G8) has created working groups and issued a 
sériés of communiqués from the leaders and actions plans from justice ministers. At the 
Halifax Summit 1995, the Group of Seven recognized “that ultimate success requires ail 
Govemments to provide for effective measures to prevent the laundering of proceeds from 
serious crimes, to implement commitments in the flght against trans-national organized 
crime.” 352 The group released 40-point set of “recommendations to combat Trans-national 
Organized Crime efficiently” at the G7/P8 Lyon Summit. The recommendations urged the 
States to increase the level of criminalization, prosecution, investigation, and international 
coopération, while acknowledging in their entirety human-rights protection. 353 

At the Denver Summit 1997, the Group of Eight proposed to strengthen their efforts to 
realize the Lyon recommendations, by concentrating on punishing high-tech criminals, and 
promoting the govemments’ technical and legal abilities to react to trans-territorial computer 
crimes. 354 The Group of Eight Meeting of the Justice and Interior Ministers of December 
1997 responded to the increased international movement of criminals, organized crime, and 
terrorists and their use of the ICT. 355 Ministers noted, in a Statement of Principles 
Concerning Electronic Crime, that, while criminal législation was a national responsibility, 


351 Commonwealth Secrétariat, The Harare Scheme on Mutual Assistance in Criminal Matters: 
Possible Amendments to the Scheme and Discussion of Interception of Communications and Related 
Matters, Meeting of Commonwealth Law Ministers and Senior Officiais, Accra, Ghana, 17-20 
October 2005. Annex 1: Summary of recommendations of the Expert Working Group, R4, p. 5. 

352 G7, Chairman’s Statement, 17 June 1995, Halifax Summit, 15-17 June 1995. 

353 P8 Senior Experts Group, 40 recommendations to Combat Trans-national Organised Crime, Paris, 
12 April 1996, Reference: 1996CIIa5. 

j54 G8, Communiqué, Denver, 22 June 1997, Denver Summit of the Eight, 20-22 June 1997. 

355 December 1997, the G8 Meeting of Justice and Interior Ministers. 
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the character of the information networks obstructed countries from operating traditional 
power over this problem. Domestic législations hâve to be complemented by international 
coopération to criminalize the abuse of the networks and harmonize the investigative 

, • 356 

action. 

At the subséquent summits, the Group of Eight repeatedly expressed their concem about 
cybercriminality. At the Okinawa Suinmit, the Okinawa Charter on Global Information 
Society adopted the principle of international collaboration and harmonization of cybercrime. 
“In order to maximize the social and économie benefits of the information society”, the 
Group of Eight agreed on principles and approaches for the protection of privacy, the firee 
flow of information, and the security of transactions. 357 

The Charter recognized that the security of the information society necessitated 
coordinated action and effective policy responses. 358 

(iii) The Organization for Economie Coopération and Development (OECD) 

With its 30 member countries, the OECD addressed computer security for several 
décades. In 1983, an expert committee was appointed by the OECD to discuss computer 
crime phenomena and criminal-law reform (Schjolberg and Hubbard 2005). Offences against 
confîdentiality, integrity or availability listed in the 1985 OECD document included 
unauthorized access, damage to computer data or computer programmes, computer sabotage, 
unauthorized interception, and computer espionage. 359 In December 1999, the OECD 
offïcially approved the Guidelines for Consumer Protection in the Context of Electronic 
Commerce (Department of Justice 2000, p. 27), representing member States’ consensus in the 
area of consumer protection for e-commerce: consumers should be protected in e-commerce 
not less than the protection they enjoyed within traditional commerce (Department of Justice 
2000, p. 27). The OECD adopted Guidelines for the Security of Information Systems and 
Networks in July 2002, calling on member governments to “establish a heightened priority 


j57 G8, Okinawa Charter on Global Information Society, Okinawa, 22 July 2000. 

358 ibid. 

359 Computer-Related Crime: Analysis of Legal Policy, ICCP Sériés No. 10, 1986. Cited in UN, 
Crimes related to Computer Networks: Background Paper for the Workshop on Crimes Related to the 
Computer Network, Tenth UN Congress on the Prévention of Crime and the Treatment of Offenders, 
Vienna, 10-17 April 2000, A/CONF. 187/10. 
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for security planning and management”, and to “promote a culture of security among ail 
participants as a means of protecting infonnation Systems and networks” (OECD 2002a, Part 

I). 

The Guidelines established nine principles, including awareness, responsibility, 
response, ethics, democracy, risk assessment, security design and implémentation, security 
management, and reassessment (OECD 2002a, Part III). Because of the nature of the 
guidelines and the distance from the legal actions, practical endeavours were left to the 
member countries to make. 


12.6 Global efforts by the United Nations (UN) 

In a certain sense, there are numerous global organizations. Nevertheless, the UN is 
capable of being identified as the only global organization that forms a forum of its 191 
member States with fuller functions. Compared with professional organizations, the UN does 
not limit its activities to certain domains. Compared with régional organizations, the UN does 
not limit its activities to certain States (in the fleld of cybersecurity protection and cybercrime 
prévention). The actions of the UN hâve unique advantages in coordinating international 
positions. 

In 1985, General Assembly Resolution 40/71 of 11 December called upon Governments 
and international organizations to take action in conformity with the recommendation of the 
commission on the legal value of computer records of 1985, in order to ensure legal security 
in the background of the broadest possible use of infonnation processing in international 
transactions. 360 

In 1990, the General Assembly of the UN adopted the Guidelines Concerning 
Computerized Personal Data Files. It proposed to take appropriate measures to protect the 
files against both natural and artificial dangers. The Guidelines extended the protection of 
govemmental international organizations (Part B). 

“The International Review of Criminal Policy: United Nations Manual on the 

360 See UN General Assembly Resolution A/RES/51/162 (30 January 1997). 
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Prévention and Control of Computer-related Crime” called for further international work and 
presented a proper statement of the problem. It stated that at the international level, further 
activities could be undertaken, including hannonizing substantive law, and establishing a 
jurisdictional base. 361 

The Background Paper for the Workshop on Crimes Relating to the Computer Network 
at the Tenth UN Congress on Prévention of Crime and Treatment of Offenders proposed two 
levels of définition of cybercrime: In the narrow sense, that is, the strict computer crime, had 
to refer to “any illégal behaviour directed by means of electronic operations that targets the 
security of computer Systems and the data processed by them.” In the broad sense, that is, 
computer-related crime denoted “any illégal behaviour committed by means of, or in relation 
to, a computer System or network, including such crimes as illégal possession, offering or 
distribution information by means of a computer System or network.” 362 

The UN General Assembly has endorsed several resolutions dealing with its desire to 
witness progress regarding this issue. According to information provided by SchjGberg and 
Hubbard (2005), checking Resolutions 55/63 (2000) and 56/121 (2001) on Combating the 
Criminal Misuse of Infonnation Technology, the value of the Group of Eight Principles was 
noted, and States were urged to consider these principles; checking Resolutions 53/70 (1998), 
54/79 (1999), 55/28 (2000), 56/19 (2001), 57/53 (2002), 57/239 (2002), 58/32 (2003), and 
58/199 (2003), ail calling on member States “to promote the multi-lateral considération of 
existing and potential threats in the field of infonnation security, as well as possible measures 
to limit the threats.” 363 These resolutions hâve the same motive to improve the cybersecurity 
awareness at both the international and the national levels. 

In Resolution 55/63, the General Assembly noted the value of the following measures to 
combat computer misuse: 

(a) To ensure the élimination of safe havens for cybercriminals; 

(b) To coordinate coopération in the investigation and prosecution of cybercrime; 

361 United Nations Crime and Justice Information Network (1999), Paragraph 295. 

362 UN, Crimes Related to Computer Networks: Background Paper for the Workshop on Crimes 
Related to the Computer Network, Tenth UN Congress on the Prévention of Crime and the Treatment 
of Offenders, Vienna, 10-17 April 2000, A/CONF. 187/10, p. 5, paragraph 14. 

363 See UN web site. 
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(c) To exchange information for fighting cybercrime; 

(d) To train and equip law-enforcement personnel to address cybercrime; 

(e) To protect the security of data and computer Systems from cybercrime; 

(f) To pennit the préservation of and quick access to electronic data pertaining to 
particular criminal investigations; 

(g) To ensure mutual assistance régimes for the timely investigation of cybercrime and 
the timely gathering and exchange of evidence; 

(h) To remind the general public of the requirement to prevent and combat cybercrime; 

(i) To design information technologies to help to prevent and detect cybercrime; 

(j) To take into account both the protection of individual freedoms and privacy and the 
préservation of the capacity of Governments to flght cybercrime. 

The General Assembly invited States to consider the measures in their endeavour to 
fîght the criminal misuse of information Systems, and decided to maintain the question of the 
criminal misuse of infonnation technologies on the agenda of its future session. 

In Resolution 56/121, the General Assembly invited States to consider the work and 
achievements of the Commission on Crime Prévention and Criminal Justice and of their 
international and régional organizations when developing national law, policy and practice to 
prevent cybercrime. 

The resolution emphasized the value of the measures set forth in Resolution 55/63, and 
again invited States to take them into account in their efforts to combat the criminal misuse of 
information technologies. However, the General Assembly decided to postpone considération 
of this subject, pending work considered in the plan of action against high-technology crime 
of the Commission on Crime Prévention and Criminal Justice. 

It is necessary to mention that, besides the advantages, the disadvantages of the UN’s 
actions are also striking. The UN is a multifunctional international organization, which in 
some sense has malfunctioned over the years. Focusing on the current topic, it can be said 
that the consensus on cybercrime in this forum remains a preliminary one. The diversified 
legal Systems of members of this gigantic organization hinder the conclusion of a fruitful 
agreement. 
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12.7 The focuses of international harmonization 


From the above présentation on international actions in anti-cybercrime areas, we can 
further summarize the major thèmes of these international organizations. These aspects 
mainly include the promotion of security awareness at both the international and national 
levels, the hannonization of législation, coordination and coopération in law enforcement, and 
direct anti-cybercrime actions. 

(i) The promotion of security awareness at the international level 

The typical actions in this aspect hâve been taken by the UN. The UN’s two Resolutions 
(55/63 (2000) and 56/121 (2001)) on Combating the Criminal Misuse of Infonnation 
Technology recalled the importance of the Group of Eight principles, and urged States to take 
these principles into account. Some other resolutions also called on member States to promote 
the multi-lateral considération of existing and potential threats in the fleld of infonnation 
security, as well as promising measures to limit these threats. Other international 
organizations also made efforts to promote security awareness at the international level. For 
example, after the 9/11 incidents, the APEC Leaders called for a reinforcing of APEC 
activities to protect critical infrastructure. 

(ii) The promotion of security awareness at the State level 

Ail international organizations hâve made efforts to promote security awareness at the 
domestic level. For example, APEC guided its member States and régions to promote 
cybersecurity and tackle the threats of cybercrime. APEC also conducted a project for 
developed States to support other States in training personnel. The Shanghai Déclaration of 
2002 supported measures to fight against misuse of infonnation. 

(iii) Hannonization of législation 

Legal harmonization has been a major emphasis on the work of various international 
organizations. Harmonization in Europe started in the 1980s and a recent achievement was the 
Convention on Cybercrime. Other international organizations hâve also endeavoured to attain 
legal harmonization. Early in 1981, Interpol surveyed the criminal laws of member States so 
as to explore defects in the existing législation, and made efforts to harmonize the laws. 
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Today, Interpol’s African Working Party on Infonnation Technology Crime Projects is trying 
to persuade the African States to sign and ratify the Convention on Cybercrime. APEC also 
took steps to survey the laws and to encourage économies to enact comprehensive laws 
consistent with the Convention on Cybercrime and the pertinent UN resolutions. The EU 
Framework Decision of 2002 specifically granted the member States the responsibility of 
criminalizing the offences of illégal access to and illégal interférence with infonnation 
Systems. The REM JA urged States to criminalize cybercrime and harmoni z e the member 
States’ laws, and consider the possibility of joining the Convention on Cybercrime. The 
Commonwealth Model Law on Computer and Computer Related Crime expanded the 
criminal liability of the Convention on Cybercrime so as to include reckless liability. Through 
this Model Law, the Commonwealth made efforts to criminalize cybercrime in the member 
countries. The Group of Eight Paris Conférence discussed the public and private interact with 
the objective of implementing an international penal code for fighting cybercriminality. The 
Okinawa Charter on Global Infonnation Society further consented to international 
collaboration and hannonization concerning cybercrime. 

(iv) Coordination and coopération in law enforcement 

Interpol’s European Working Party on Information Technology Crime compiled the 
Computer Crime manual to provide technical guidance in law enforcement. The Convention 
on Cybercrime also covers cooperative mechanisms in law enforcement against cybercrime. 
The EU discussed about the rétention of traffic data in 2001. The Ministers of Justice or 
Ministers or Attorneys General of the Americas (REMJA)’s Group of Experts on Cybercrime 
hâve been devoted to discover coopération ways in the Inter-American System to combat 
cybercrime. The Group of Eight reviewed existing coopération mechanisms and gaps, and 
made attempt to discover ways to fill these gaps. The Group urged the States to increase 
criminalization, prosecution, investigation, and international coopération. The Denver Summit 
proposed to promote governments’ technical as well as legal abilities to act in response to 
trans-territorial computer crimes. The Birmingham Summit called for agreement on a legal 
framework for evidence préservation and protection of privacy, and for agreements on the 
international sharing of evidence so as to struggle more effectively against a broad scope of 
crimes, including cybercrime. 
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(v) Direct anti-cybercrime actions 

The direct international anti-cybercrime actions comprise two fondamental aspects: 
cybercrime prévention and cybercrime investigation. They hâve been more valuable before 
international hannonization in législation could corne into being. Different organizations hâve 
taken individual measures with spécifie emphases. For example, Interpol directly cooperated 
with credit-card companies to fight against payment firaud. The OECD’s Guidelines for 
Consumer Protection in the Context of Electronic Commerce 1999 emphasized the protection 
of consumers in e-commerce as well as that in traditional commerce. Guidelines for the 
Security of Infonnation Systems and Networks 2002 called on member govemments to 
“establish a heightened priority for security planning and management”, and to “promote a 
culture of security among ail participants as a means of protecting information Systems and 
networks”. 


12.8 From conversation to the European Convention 

As one of the most outstanding achievements, international actions bred a comparatively 
effective implémentation: the Convention on Cybercrime and its Protocol. The general 
purpose of the Convention is laid down in the Preamble as to deter crimes against the 
confidentiality, integrity and availability of information Systems and the misuse of such 
Systems. The purpose of the Protocol is to supplément the provisions of the Convention on 
cybercrime on the criminalization of acts of a racist and xénophobie nature committed 
through information Systems (Protocol, Article 1). 

The Convention has been widely accepted as a landmark, providing for both the 
substantive and procédural legal frameworks, both the domestic and international level of 
countenneasures, so as to achieve higher effectiveness in fighting against cybercrimes. 364 

Articles 2-12 of the Convention hâve required nations to criminalize the activities of 
illégal access to data and computer Systems; illégal interception; data and Systems 
interférence; misuse of devices that can be used to enact the aforementioned crimes; 
364 Convention on Cybercrime, Preamble, Paragraph 9. 
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computer-related forgery and fraud; content-related offences including child pornography; 
copyright crimes; and attempt, aiding or abetting. Article 13 of the Convention also 
establishes corporate liability, and sanctions and measures for these offences. Articles 3-7 of 
the Protocol requires nations to criminalize the activities of disseminating racist and 
xénophobie infonnation through information Systems. Also to be criminalized is racist and 
xénophobie motivated threat, racist and xénophobie insult, and in respect of génocide or 
crimes against humanity, déniai of their existence, gross criminalistic approval or justification 
of them, and the behaviour of aiding and abetting them. 

The Convention provides two constituent éléments for cybercrimes. First, the 
Convention establishes criminal liability on the subjective element of intent. Sometimes, the 
constitution of certain offences requires éléments such as intent to procure “économie 
benefit” in computer-related fraud provided by Article 8. Second, the Convention establishes 
criminal liability on the objective element on act “without right” in ail offence provisions. 365 
The problems of what is an act committed intentionally, what is an act with right and without 
right, are ail left to national law interprétation. 

The Convention allows domestic laws to provide additional constituent éléments, and 
provides the possibility of a réservation. 366 Apparently, the Convention fully respects the 
decision-making of member States on the matter of criminal policy. As a resuit, we hâve good 
reason to worry that this diversified implémentation will decrease the consensus on the 
harmfulness of conducts and increase the possible obstacles to international actions. The 
négative effect of this kind of provision is expected to diminish the effectiveness of 
prolonged expensive international negotiation for an agreement, although the provision itself 
is exactly one of the contents negotiated and agreed upon. 

The Convention has also been criticized by civil liberties groups concerned that it will 
undennine individual privacy rights and that it expands too greatly surveillance powers, and 
is fundamentally unbalanced. As Taylor (2004) pointed out, the Convention contains 
comprehensive, far-reaching powers of surveillance, search, and seizure, while lacking a 


365 Convention on Cybercrime, Articles 2-12. 

366 Ibid, Articles 40 and 42. 
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criterion for the protection of privacy and limitation of power . 367 The basic concerns in the 
field of human rights are the over-expansion of the States’ power of surveillance, and 
over-criminalization of citizens’ behaviour. Before infonnation Systems hâve been completely 
developed, the States would strictly take this borderless System under control; those who use 
information Systems would voluntarily enter the tight legal encirclement. For those who use 
information Systems before these legal instruments, they are to accept externally imposed 
constraints; while for those who use information Systems after these provisions, they are born 
into an inhérent limitation. Both these two groups of users may feel a loss of freedom of 
information. 

Despite the anxiety mentioned above, the Convention has unquestionably had some 
influence on the worldwide consensus in relation to the predicament of cybercrime. We are 
capable of seeing that the Convention will become one of the important steps towards a 
broader international accomplishment. 

Firstly, some countries hâve taken practical measures to ratify the Convention. The total 
number of ratifications and accessions is 19 countries, including one non-member State of the 
Council of Europe, the U. S., with 24 countries (including three non-member States of the 
European Council, Canada, Japan and South Africa) having signed the Convention, not 
followed by ratifications. 368 The treaty has entered into force in only a small number of 
countries, representing a small proportion in terms of land area and population. However, it is 
still an important step towards a broader consensus: “A little is better than none.” 

Secondly, besides successful endeavours, countries, including most signatory countries, 
are still on their way to ratifying the treaty. The Council of Europe Conférence on 
“Cybercrime: a Global Challenge, a Global Response” in 2005 “strongly encourage States to 
consider the possibility of becoming Parties to this Convention in order to make use of 
effective and compatible laws and tools to fight cybercrime, at domestic level and on behalf 
of international co-operation.” 369 The treaty has corne into force in some of the Nordic 

367 Taylor, G. The Council of Europe Cybercrime Convention: A Civil Liberties Perspective, 23 July 
2004. Retrieved 15 March2007, from http://crime-research.org/library/CoE_Cybercrime.html 
j6s See Council of Europe, Convention of Cybercrime, CETS No. 185, Chart of Signatures and 
Ratifications, 19 February 2007. 

369 Council of Europe, Conclusions of the Council of Europe Conférence on “Cybercrime: a Global 
Challenge, a Global Response”, Madrid, 12-13 December 2005. 
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countries, including Denmark, Iceland, and Norway, but Finland and Sweden are still seeking 
ratification though they were both countries of signature on the date opening for signature in 
2001. 370 

However, this process has proved hard without the expected number of countries 
ratifying in the five-year period after the Convention was open to signature. The pressure 
against not ratifying the treaty coming from inside the countries seems to be a greater 
obstacle than the différences over the drafting of the document. A significant obstacle cornes 
from the différence of legislative styles between the Convention and the individual countries. 
Many of the valid provisions in current Finnish law do not need révision. 371 Whether the 
original Finnish Penal Code (which includes quite a few révisions concerning offences 
relating to data processing) is capable of dealing with ail of the offences provided by the 
Convention has not been tested in judicial practice. But the Finnish législature will hâve to 
add some new provisions to the Penal Code, if it wants to cope with the Convention. 
Expressly, provisions concerning the offence of interférence with and gross interférence with 
the information processing Systems, the offence of possession of instruments for cybercrime 
(covering the computer viruses), the liability for inchoate cybercrime, and for corporate 
liability, and so forth must be taken in. 372 

The critical challenge of the Convention on Cybercrime to conventional international 
legal coopération lies in the absence of a demand for the double criminality criterion. Since 
this criterion is in décliné, individual countries are far from implementing it in domestic law, 
either. In accepting the Convention, individual countries will therefore hâve to revise 
domestic laws in the relevant area. 373 

Some other countries are seeking to remodel the Convention so as to provide a 
prohibition on the types of conducts and to create procédural and international mechanisms 
for serving successful investigations and prosecutions of crimes. The flexibilities of the 


j70 See, for example, the Governmental Proposai HE 153/2006 of Finland, which aims at bringing 
the Convention on Cybercrime and the European Union’s Framework Decision on Attacks against the 
Information System into force in Finland and making relevant révision in domestic provisions 
according to the Convention (HE 153/2006, 3. Objectives and Central Proposais). 

371 HE 153/2006, Detailed Justifications. 

j72 HE 153/2006, General Justifications, 3. Objectives and Central Proposais. 
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Convention may hâve a positive effect in leaving to member States the alternative of using 
different methods and languages in their domestic law. This may actually lead to a wider 
application of the Convention so as to cover more and diversified legal Systems. While the 
U.S. has asserted that its own domestic law dos not need révision, South Africa has 
implemented substantial criminal provisions in line with the Convention. Japan is considering 
fîlling the gap between its domestic law and the Convention. At least, among the APEC 
économies, Taiwan, the Philippines, and Hong Kong are considering taking the Convention 
as the basis on which they will carry out their own legislative amendments. 

Some international organizations are propelling coopération in promoting the member 
States’ access to the Convention. As mentioned above, in the framework of Interpol, the 
African Working Party on Information Technology Crimes is working to promote domestic 
législation and adhérence to the Convention. APEC, the EU, and the REMJA V of the OAS 
hâve also taken measures to spread the Convention to its member States. 

There are also efforts to develop cybercrime législation beyond the Convention. As 
mentioned above, the Commonwealth’s model law represents a breakthrough in extending 
criminal liability to the mens rea of offenccs of interfering with data, interfering with 
computer Systems, and illégal devices so as to include reckless liability. Some of the 
Commonwealth’s member States are also on their way towards législation that will model the 
Convention and model domestic law. 

Finally, in fact, most countries, particularly countries where cybercriminals are usually 
left at large, hâve taken no action in spite of the importance of the Convention. These 
countries hâve very spécifie interests in maintaining what may be considered “criminal” in 
other countries but are “legal” in their own countries, as far as web sites, services, or even 
sales of goods online are concemed. The potential cybercrime perpetrators, regardless of 
whichever nationality they belong to, also seek asylum in such countries in order to escape 
punishment by countries that are seeking to extend their judicial arms to deal with cases 
committed inside their sovereign territory and committed by their citizens outside their 
territory. 

Although the Convention on Cybercrime has been attracting increasing attention at both 
the domestic and international levels, it is necessary to point out that, once the Convention 
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was in documentary fonn, the enthusiasm and efforts of other international entities towards a 
higher degree of international harmonization of législation hâve been to some extent 
weakened. This situation reflects neither the purpose, nor the intended side effect of the 
Convention. However, a ready instrument must hâve its négative influence on the otherwise 
unsettled disputes of the problems of cybercrime deterrence. Regrettably, both the advantages 
and disadvantages of the Convention will bring about a more cautious discussion and a better 
plan will be discouraged from being implemented. At least, the similar but different schedules 
for international treaties, in either broader or narrower scope, hâve seen an interruption with 
the passing of the Convention. The Convention thus becomes not only a mutual compromise 
of member States, but also a tuming-point in the knowledge and expériences of cybercrime 
punishment and prévention. 

Traditionally, new legal instruments hâve usually been the subject of academie 
annotation immediately after its implémentation, while the législature is usually reluctant to 
change existing legal instruments. These two factors further détermine the unfortunate fate of 
the better and newer proposais, particularly proposais having more or less better éléments 
than the implemented one. In a word, we can say that classics were good, but classics hinder 
better classics; consensus are good, but consensus always hinders better consensus: and the 
Convention is good, but it potentially hinders a better convention. 

Although the Convention was also appraised by politicians, such as the U. S. President 
George W. Bush, as “providing for broad international coopération in the fonn of extradition 
and mutual legal assistance”, and containing “safeguards that protect civil liberties and other 
legitimate interests” (Bush 2003), the effectiveness of the Convention’s cooperative 
framework is subject to reasonable doubt without a majority of countries’ access to the 
agreement (Goldsmith 2005, p. 4). Authors such as Archick (2004) hâve proposed that the 
Convention’s arm would not be long enough to reach the countries that are regarded as a 
“haven” for cybercriminals: attacks are launched from those countries, but the countries do 
not join the agreement. Consequently, the countries with law and without law, or being the 
member and being non-member of the Convention, hâve to encounter mutual conflicts. The 
situation confronting international society is obviously still one of the tardiness of the 
acceptance of existing instruments and the lack of a universal agreement. 
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12.9 Limited progress in international harmonization 


Over the years, the international co-operation on cybercrime “has been very active and 
comprehensive” (Pihlajamaki 2004, p. 286). The international level of consensus on criminal 
law has, however, not been achieved. Previously, the criminalization of war crimes, crime 
against peace, crimes against humanity, génocide, torture, and other crimes hâve been the 
successful examples. The application of pertinent agreements in spécifie courts has 
demonstrated that an international forum can acquire certain achievements prior to législation 
at the national level. Traditional international criminal law has aimed at hannonizing 
substantive law and coordinating procédural law on offences that hâve existed in society since 
the coming into being of humankind. Presently, what the countries are eager to realize is 
an international agreement on offences with a history of only several décades. The anxiety for 
success, the absence of trial practice, the lack of an accumulation of expérience and 
knowledge, the alienation between the législature and general public, and the different 
interests between the various countries, ail deliver an international consensus in its lowest 
form. It is inévitable that during the drafting stage and particularly after the Convention on 
Cybercrime has been opened for signature, many commentators hâve published their 
évaluation and criticism. 375 Combined with other progress made in international 
hannonization, the most important unsolved problem may be the limited participation and the 
limited consensus. 

Firstly, international hannonization has hitherto been primarily the forum of the 
developed countries. The working mechanism of an effective international treaty is for ail of 
the signatory countries to take effective action and preserve a common theatre of operation. 
The treaty is not aimed at any third party and thus the third party is not restrained by it. The 

374 The origin of human beings has been an unsolved theoretical problem. Genesis theory and 
evolutionary theory might be the most influential arguments. 

375 For an overall évaluation on the Convention on Cybercrime, see Jones (2005). The Convention 
was also subject to criticisms from individuals and organizations, such as the American Civil Liberties 
Union and others. 
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participating countries of the Convention on Cybercrime are limited, representing only a 
limited population. Along with the development of the Internet globally, the number of 
cybercrimes will be correlated with the population base of Internet pénétration, and the global 
population base. Most of the présent international harmonization measures hâve not been 
incorporating the countries with the largest population. This will make the measures less 
effective. Considering the characteristics of cybercrime, the “safe haven for criminals” can 
only be eliminated when almost ail the sovereign States hâve access to one agreement and 
almost ail the online users are subject to the power of law enforcement. Although an 
international document can be modelled by member States when making domestic laws, the 
expectations should not be raised too high in respect of a timely update at a similar pace when 
it cornes to international measures. 

Secondly, another limitation is that a lower level of consensus has been reached. Unlike 
traditional offences in international criminal law, which hâve rarely been penalized in 
domestic law, cybercrime was initially devised in the législation at the national level. In many 
countries, domestic législation on offences such as génocide, crime against peace and similar 
types of crime did not happen before the countries were subject to the obligation of 
international treaties. The situation of cybercrime is that countries that hâve already enacted 
laws assisted or forced the countries that hâve not enacted laws to enter a consensus. As a 
whole, international coopération in preventing cybercrime is more sluggish than domestic 
législation; its impact on domestic législation is, nonetheless, undeniable. Domestic laws 
should be amended according to international instruments so that the measures provided in 
the international instruments can be effectively carried out. An agreement on a wider scope of 
issues in cybercrime is also necessary so as to ensure effective law enforcement. However, 
such an agreement is still lacking. The efforts of various international organizations should be 
integrated into a more unified action. 

Thirdly, there is, strangely, a tendency towards pluralization on the international 
hannonization. In regulating or deregulating the infonnation community, different interest 
groups stay at different standpoints. In criminalizing and decriminalizing the online activities, 
different players hold different opinions. Different organizations propose countenneasures for 
the benefït of a certain number of their member States. Yet other organizations oppose any 


335 



kinds of plans for imposing constraints on the free use of infonnation Systems. The 
mechanism is that while one interest group is anxious about the misuse of infonnation 
Systems, another group may concentrate on the side-effect of anti-misuse actions. Various 
international hannonization measures are full of a trade-off of interests and a contrast of 
powers. This marathon process of negotiation has inherited the inhérent style of international 
actions. 

Fourthly, another tendency is the regularization of international hannonization. The effect 
of international hannonization is less significant compared with the efforts. The rôle of the 
UN as a universal international organization seems limited to arranging an international treaty 
in this area. If the United Nation’s frequent “call” does not motivate member States to 
legislate on cybercrime, a universal agreement would be a better alternative in promoting 
consensus. The UN may hâve the opportunity to incorporate the consensus reached in other 
fields into the above-mentioned unified action. 


12,10 Conclusion 

Globalization does not mean globalized welfare at ail. Globalized information Systems 
accommodate an increasing number of trans-national offences. The network context of 
cybercrime makes it one of the most globalized offences of the présent and the most 
modemized threats of the future. We can take actions in two different ways to résolve this 
problem. One is to divide infonnation Systems into segments bordered by State boundaries. 
The other is to incorporate the legal System into an integrated entity obliterating these State 
boundaries. Apparently, the flrst way is unrealistic. Although ail ancient empires including 
Roman, Greece, and Mongolia became historical remnants, and giant empires are not 
prévalent in current world, the partition of information Systems cannot be an imagined 
practice. Information Systems become the unique empire without tangible territory. 

Offences occurring in information Systems are not likely to receive punishment from this 
System. Rather, they are punishable by the territory-based States that they cross. It is 
increasingly stringent and necessary to establish an international coopération System for 
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punishing cybercrime. Various international organizations hâve taken actions to résolve the 
problem in different forums and at different levels. 

The Convention on Cybercrime is acknowledged as a landmark in the sphere of the 
international harmonization of cybercrime law. 376 However, apart from the fact that it 
represents a significant step forward, more States will hâve to sign the Convention and abide 
by its mandates in order to serve as a deterrent. International harmonization centred on the 
Convention is obviously limited and must necessarily be extended to more participating 
member States with an even wider scope of issues. The final effect should be achieved only 
through a universal agreement on combating cybercrime. The UN may hâve higher potential 
to implement such universal measures. However, we should not expect an instantaneous 
reaction from any of the international organizations, because not too much attention and 
interests of these international organizations are concentrated on the problem of crime or 
precisely, on cybercrime. While these organizations are devoted to dealing with the more 
important international affaire, threats against a critical information infrastructure will 
become more serious, until they are listed at the top of these organizations’ schedule. 
Consequently, the development of an international level of consciousness and an international 
level call for a national level of consciousness are still the grounds for effective actions. The 
need is to reassess and renew as necessary the présent international legal frameworks, 
offering a forum for broader international discussion expressing an outlook towards 
increasing and advancing international law-enforcement coopération among the national 
authorities. This development should consider the influences of the novel and emerging 
issues in respect of international law-enforcement coopération, with recommendations on 
capacity-building, which should show an equal concem for the situation in countries at 
different stages of development so as to avoid a futureless future of information chaos. 


j76 See the Council of Europe Cybercrime Conférence, Conclusions, 15-17 September, 2004 
High-level Conférence on the Challenge of Cybercrime. 
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CHAPTER 13. CONCLUDING RECOMMENDATIONS 


13.1 Dilemmas of cybercrime control 

The possibility of disseminating information in large quantities and at high speed serves 
both legitimate and illegitimate purposes. Cybercrime can be seen as a by-product of 
cyberspace, which is the product of infonnation and communications technology. The current 
information Systems are insecure Systems, while the présent Internet is an insecure network. 
Crime is a phenomenon that easily emerges but is difficult to eliminate. The phenomenon of 
cybercrime is the silhouette of the information society. The Internet services lack of 
controllability and become the breeding ground of cybercrime, as a response to which many 
govemments hâve enacted spécifie législation criminalizing invasive and destructive 
activities targeted at infonnation Systems. Because cybercrime, committed with the assistance 
of the globally-connected computer networks, can easily cross the territorial borders, it is 
unknown but broadly accepted that different countermeasures may create a paradise for 
cybercriminals. Great challenge has been posed for cybercrime control (Grabosky 2000, pp. 
9-16). Consequently, a critical step will be the élaboration of coinmon international raies 
concerning these crucial factors so as to fill the legislative and jurisdictional gaps. 

Technology should be the preferential choice for eradicating cybercrime. Cyberspace 
can be considered as the expansion of society, while cybercrime is the extension of criminal 
phenomena. Although cyberspace is not entirely independent, there is the possibility and even 
necessity for autonomy within the independent factors. Technicians are constantly inventing 
technological countermeasures to deal with issues of cybersecurity, but an increasing number 
of commentators argue that the techniques of security cannot keep pace with techniques for 
discovering loopholes in information Systems and for launching attacks on information 
Systems. It is impracticable to solve the whole problem merely by technology. 

Cybercrime mobilizes law. Criminal law and other laws, professional codes, industrial 
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self-discipline and user ethics form guidelines, though their functions are quite varied as 
between the different countries. Most of the modem démocratie countries do not use 
penalties as primary means for correcting human behaviour. Criminal law remains the main 
tool. However, if criminal law cannot respond to the reality of crime, if law cannot be enacted 
to impose a suitable liability on harmful activities, and if law cannot be enforced by qualified 
personnel, the law will unquestionably be ineffective. In fact, in the current technological 
environment, législature and law enforcement can hardly adjust their activities in response to 
the new situations. Criminal law becomes a law the principle and stability of which hamper 
its inhérent functions. This is contrary to the nature of law. 

Even some high-profile law-enforcement offïcers can fail in detecting offences, or 
misuse their posts to serve political ambitions, or fabricate fictitious cases. As some of their 
failure and misconduct become better known, the placing of trust in them will be 
accompanied by great risks. Apart from this concern, law-enforcement agencies, even in 
normal situations, hâve found that it is much more complex to detect, investigate, and convict 
cybercriminals than traditional criminals. In the networked world, it has become increasingly 
uncomplicated for criminals to avoid conviction by acting from a country where a conduct is 
neither criminalized nor prosecuted. International coopération and legal hannonization are 
necessary for reducing investigation costs and increase enforcement effects. The Convention 
on Cybercrime is therefore used by governments in order to harmonize their cybercrime laws 
and increase coopération and coordination between national law enforcements agencies. 
However, there is an especially long road before perfect hannonization is achieved. 
Unification of substantive criminal law, hannonization of jurisdiction, coordination, and 
coopération in cybersecurity protection and cybercrime prévention, will ail contribute to 
lower the cost of deterrence. 

As we mentioned above, the insufficiency of the existing legal framework and the 
inelficiency of détection and conviction imply that high costs will be involved in 
cybercriminal law enforcement. Seneca stated that: “He who does not prevent a crime when 
he can, encourages it.” (Lucius Annaeus Seneca, Troades CCXCI) The problem at présent is: 
“He who does not prevent a crime when he cannot, also encourages it.” In addition to the 
technological obstacles, the limits imposed by State borders and the difficulties in establishing 
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international cooperative mechanisms render it burdensome to combat cybercrime effectively. 
The low quality of law and its enforcement finally results in injustice and inequality, 
destroying the long established principle of legality. An inefficient and ineffective legal 
framework for control over cybercrime will run the risk of creating new unfaimess in the 
information âge. The infonnation society does not definitely lead to a harmonious world. 
Although pervasive infonnation enables people of ail circles to be more informed, and to 
work more effïciently and more effectively, it raises multiform questions. The distributive 
disequilibrium of infonnation of various values between groups results in unbalanced power 
of control as well as anti-control forces. The deficiency of law and the prevalence of 
lawlessness may become two of the most notorious négative factors. 

From the standpoint of the above analysis, a worldwide unified model substantive and 
procédural cybercriminal law would be idéal but not practical. Régional international 
coopération has a better basis and can be used to improve the législation of participating 
member countries. Negotiation and coopération among the developed, developing and 
transition countries provide the most important forum for eliminating the refuge for 
cybercriminals. 

The above discussion implies that law is not likely to be perfect. At the same time, we 
must also note that even if there is perfect law, it is not the perfect solution. Law must be 
enacted by some persons against some other persons. The absence of either a subject or an 
object in law enforcement would leave the law ineffective. Law enforcement has also 
frequently been disappointed with the effect of traditional crime prévention. The situation of 
cybercrime has nothing more spécial than its traditional counterparts in improving the 
prévention effect. Criminals hâve escaped détection regardless of the existence of law and of 
the police. We can be convinced by many findings and conclusions about traditional crime 
control programmes, for example, the situation in the following comments described by 
Duckett: 

“Gun control has not worked...The only people who hâve guns are criminals. We hâve 
the strictest gun laws in the nation and one of the highest murder rates. It’s quicker to pull 
your Smith and Wesson than to dial 911 if you're being robbed.” (Duckett, Washintong Post, 
22 December 1996) 
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Particularly, the private sector of the information society should not wait for any 
extemal remedies for their cybersecurity. Direct and instant approaches to protecting their 
information assets and online business is self-protection, upon which coordinative and 
cooperative mechanisms can be used as the ex post remedies. Practically, the function of 
judicial activities is to inflict liability on parties involved in the création of insecurity, even 
though the supposed general deterrence of penalty can also forestall potential criminals from 
behaving detrimentally. 

Neither law nor technology can do everything, even in their duties. The more 
appropriate strategies for the control of cybercrime require an arrangement of law 
enforcement, technological and market-based solutions. Obviously, even if we combine ail 
these measures, the problem would still not be solved. This récognition has become a 
consensus among cybersecurity and cybercrime researchers. For example, McConnell 
International (2000, pp. 1 and 7) stated that “self-protection” is inadéquate to secure the 
cyberspace, and the law is necessary to play its rôle; however, “law is only part of the 
answer.” These dilemmas of maintaining cyberspace order necessitate the adoption of 
comprehensive measures. Pâme la Samuelson (1989) mentioned that: “The law may not be 
the most precisely sharpened instrument with which to strike back at a hacker for 
damages...but sometimes blunt instruments do an adéquate job.” Law in itself will hardly be 
able to act as complété substitutes for security measures. The law will hardly hâve enough 
déterrent power if the majority of people are unaware of its range and sense. Cybercriminals 
habitually consider that they are problem-solvers other than lawbreakers (Leiwo 1995, p. 50). 
The traditional hacker even thought the supposed “freedom of information” means that ail the 
computers and networks should be open to every user. Under their codes, rules or ethics, the 
legal framework that traps the unauthorized intruders in infonnation Systems becomes an 
injustice. To awaken public awareness and consciousness concerning privacy and security, 
the task falls on the shoulder of éducation, and the market. In the end, ail these measures are 
necessary, but none of them can work in an optimistic manner alone. 


13.2 The primary factors benefiting cybercrime 
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From the analysis and discussion in this dissertation, it is possible to draw several 
fundamental conclusions on why cybercrime exists and spreads. The explanation on the 
causes of crime has produced many criminological théories. Grabosky, Smith, and Dempsey 
(2001, pp. 2-3) turned to Cohen and Felson’s routine-activity theory (1979) and described an 
online presence of motivated offenders and suitable targets, and online absence of capable 
guardians. The factors involved in the dynamic interaction of cybercrime and the peripheral 
environment may be even more numerous. The opportunities for crime, the motivation of 
criminals, and lack of deterrence make it safer to commit cybercrime than traditional crime, 
and make it more bénéficiai to commit crime than to be engaged in legal occupation. I 
consider the following as the primary causal factors of the above phenomenon: 

(i) Cybercrime is the natural extension and irrésistible tendency of criminal phenomenon 
in infonnation Systems. As Chapter 8 partly shows, to explore the reasons why there is 
cybercrime, it is inévitable to identify the root causes and évolution of crime. Crime has 
existed since ancient times, will exist etemally, but its nature changes along with the 
development of society. Wherever there are human activities, there will be déviances. As 
Radzinowicz and King pointed out: 

“No national characteristics, no political régime, no System of law, police, justice, 
punishment, treatment or even terror has rendered a country exempt from crime.” (1977, p.3) 

Information Systems hâve been integrated as an inséparable part of society, and the 
traditional social problem will surely settle down in the new world. The inévitable fate of 
information Systems can be expected to be similar to ail the previously existing new worlds in 
human history. Although types of crime may be different from each other, criminality will 
develop together with an increase in criminal utility. In an information society, crimes are 
naturally symbolized by information. These crimes are committed using infonnation Systems, 
abusing information Systems, and through information Systems. The new crimes inherit the 
genetic characteristics of the old crimes, even though these characteristics may evolve and 
change. Cybercrime is the product of the évolution and change in traditional crimes, being a 
component of the changed criminal System, but not a brand-new création. People should be 
neither frightened nor be unprepared for such a natural historical phenomenon. 
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(ii) Cyber transgressors and criminals lack a sense of guilt. The lack results from both 
internai and external factors that distort value judgement, that is, the perpetrator’s and the 
public’s ambiguous attitude towards such activities. Bequai (1983, pp. 70-84) brought 
forward the viewpoint of “lack of ethics as a cause of crime,” criticizing society’s “glorifying 
the computer criminals” (p. 72). Cornwall (1987, pp. 134-137) discussed the “lack of moral 
clarity” in the whole white-collar crime. From this aspect, though not ail cybercrimes can be 
categorized as white-collar crimes, they hâve a similarity to white-collar crime. Cyberspace is 
a virtual world, in which there is a lack of social supervision over ail conducts; it is in a 
hidden environment and one that is difficult to trace back. At the same time, the police remain 
blind to cybercrime to a great extent. Many perpetrators are even proved to think that the 
crimes they commit using the Internet represents their high intelligence quotient. In addition, 
there are the cases where virus authors and hacking perpetrators are praised and even hired for 
key positions in the information security industry. Ail this misinfonnation regarding virtue 
and vice removes the sense of guiltiness of the transgressors and criminals, stimulating the 
criminal mind, obliterating security and insecurity, and confusing the right with wrong. Under 
the control of this kind of consciousness, people are willing to engage in criminal actions, 
unlike most of us whose mental status is against any apparent déviance. Decency and 
déviance are contradictory orientations. 

(iii) Many users hâve a strong curiosity to access information Systems and an intense 
desire for self-manifestation. Chapters 2, 6, and 8 had much to say about how cybercriminals 
become motivated. When the U. S. computers were attacked by Morris, it was recognized that 
“government and commercial experts were less prepared to deal with the worm invasion than 
were students” (Marshall 1988, p. 1121). In order to maintain information security, most 
networks are pennitted access only to those authorized or to registered users. The 
unauthorized users are denied access through identity and password checks and other 
access-control mechanisms. However, this often touches the very thing that inspires coinmon 
human nature -curiosity. In the face of the data that hackers cannot access, they develop 
malicious programmes to intrude into the unknown fleld, or they crack the passwords to probe 
into the closed space driven by curiosity. By cracking the networks defence and accessing 
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information Systems, they demonstrate the high level of their technique, and considering this 
process as an intelligent challenge. 

(iv) The low cost of cybercrime and the diffïculty in détection and evidence collection 
create incentives for potential perpetrators (see Chapters 3, 4, 6, 7, 8, and 9). The nature of 
high intelligence, trans-territoriality, and high concealment of cyber transgress and 
cybercrime make it difficult to detect and investigate the cases (See Conly 1991; Clark 1996; 
Stephenson 2000; Mandia and Prosises 2003; Mohay and co-workers 2003; Vacca 2005; 
Johnson 2006). Stating from another standpoint, cybercrime surpasses the current capacity of 
public and private regulators to control (Grabosky 2000, p. 2). As for the transgressors or 
criminals, they usually only need to click the mouse or knock the keyboard at home or in the 
office in order to commit the illegality in a short time. The risks and costs are in cybercrime 
lower than those in traditional crime, while the benefits are higher. This cost-effectiveness 
further strengthens the mind of the perpetrator to commit cybercrime. 

(v) A lag of cybersecurity législation diminishes the striking force against cybercrime 
(see Chapters 8, 9, and 12). From the early days, scholars hâve recognized the importance of 
legal countermeasures. “The problem of computer crime is, in great part, the failure of our 
laws, jurists, lawyers, and law schools to adapt to the needs of a changing environment.” 
(Bequai 1978, p. 197) Particularly, “the legal establishment has shown a réluctance to meet 
change.” (ibid.) Due to the mere absence of législation, many famous hackers never received 
corresponding punishments. Some others were questioned or even detained for some time 
before no law can be found appropriate to convict them. There is no universal international 
consensus on what exactly cybercrime is, and who has the capacity to exercise jurisdiction. 
Meanwhile, cyber police hâve been established only in recent years, and law enforcement is 
still at the testing-stage. In addition to the legal gap, the weak punishments help minimize 
prévention (McConnell International 2000, p. 8). For many scholars, more severe penalties 
are the definite choice for strengthening deterrence, but still others doubt whether it will be 
the “answer” for the virus authors (Vamosi 2003). These doubts diminish the striking power 
against cybercrime, and further reinforce the criminal mind. 

(vi) The insufficiency of cybersecurity management leaves a backdoor for possible 
intrusion (see Chapters 3, 4, 7, and 8). Traditional business security measures were designed 
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to safeguard premises physically and deter perpetrators psychologically, ranging from 
restricted accessibility, removal of outside visibility, and reducing escape possibility, 
particularly guarding the target outside of business hours (Aromaa and Laitinen 1994, pp. 
47-101). Since the management was changed from manual to automatic, management 
consciousness and methods hâve fallen behind the development of information Systems. The 
absence of vigilance (Bequai 1978, p. 15) may dérivé from the fact that individuals and 
organizations think more about benefits, the convenience and development of the business 
than of security management. The capital and human resources invested in security 
maintenance does not fumish the necessary safeguard. The unauthorized disclosure or 
acquirement of confîdential information may be achieved through a “compromised storage, 
handling or disposai of computer devices or electronic data media,” regardless of the 
availability of security safeguards and awareness of govemments and businesses about their 
responsibility for protecting the security of information. In addition, we never deny the 
technological involvement of various kinds of cybercrimes, but we also think that there is 
some truth in the conclusion that Felson (2002) came to: 

“Most computer fraud is traced not to brilliant hackers but rather to those who leave their 
passwords on top of the desk with their office doors open, or who dump the technical manuals 
in the trash bin, or who used to work somewhere and still access information they shouldn’t.” 
(p.175.) 

(vii) Loopholes in the computers and networks technology expose the System to attacks 
(see Chapters 3, 4, 7, and 8). No operating System is hacking-proof. The malicious 
programmes exploit the loopholes of the operating Systems and launch attacks. The security 
measures are often falling behind the activities of the loophole-seekers. In addition, 
sometimes the users do not instantly apply security measures. These factors can be 


j77 Sale of Provincial Government Computer Tapes Containing Personal Information, Re, 2006 
CanLII 13536 (BC I.P.C.). In this case, personal information was at risk simply through the sale of 
government assets, among which were 41 computer tapes containing thousands of highly sensitive 
records, including medical conditions such as HIV-positive diagnosis, mental illness and 
substance-abuse, thousands of individuals’ names with social insurance numbers and dates of birth, 
details of applications for social assistance, and caseworker entries divulging extremely intimate 
information about people’s lives. Besides, about 22 sold hard drives had not been wiped away, with 
government data accessible. Ail this happened due to simple mistakes made in good faith by individual 
government employées. 
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summarized as the problem of computers and networks technology. Thus as the critical factor 
of modem society, information Systems become the vulnérable target of modem crime. The 
need for security (Bequai 1978, pp. 19-24) remains a critical element in safeguarding 
information Systems. 

(viii) The Insufficiency of family and school éducation and discipline grants juvéniles 
more opportunities to abuse computers and networks (see Chapter 6). In cyber transgress and 
cybercrime, juvéniles constitute a critical proportion of the perpetrators. The prevalence of 
computers, the Internet, and their use in the home create for parents the important task of 
teaching juvéniles to use computers and the Internet correctly. In many countries, parents are 
important figures for the éducation of their children. But, if many parents do not hâve much 
computer knowledge when they buy computers for their children, children lose parental 
constraints. Then, the use of computers is an absolute freedom and results in cybercrime. To 
some extent, nonetheless, the families and schools can prevent children from perpetrating 
cybercrime and being victimized in the first place. 

(ix) The functional weakening of traditional social communication disorganizes the 
traditional interpersonal relationship by seeming to require instant communication. The theory 
of social disorganization has been used to explore deeply into social communication (Mowrer 
1942; Elliot and Merrill 1961). Social disorganization may be the conséquence of many 
factors. We think that there is a basic reason behind the numerous factors, that is, the 
abundant available infonnation in urban and urbanized régions. Traditionally, the necessity 
for strong interpersonal communication results from scarcity of information. But nowadays 
the residential concentration in an urban area or urbanized area, the development of electronic 
media and télécommunications devices, and the dissémination of free information by various 
means are meant to solve the problem of information scarcity. Under such circumstances, the 
acquirement of information traditionally through interpersonal communication becomes 
insignifiant. Upon meeting the need for such infonnation, curiosity drives the Internet users 
to access more information from the international information Systems. With the enlargement 
of the incompact online community, the size of the compact offline community is shrinking. 
The vanishing real interpersonal communication and the emerging Virtual interaction will 
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direct interest groups in cybersecurity. Social mechanisms relying on cyber police are simply 
not enough to maintain cybersecurity. Therefore, it is important for users to raise their 
law-abiding consciousness, grasp technology to prevent abuses, and enhance their ability of 
self-protection. To a certain extent, the frequent happening of cybercrime results either from 
lack of a law-abiding conscience or from the lack of a self-protective consciousness. To 
educate users is an urgent affair, which should be emphasized at the international level, as the 
WSIS (2003) has proposed: 

“A global culture of cyber-security needs to be promoted, developed and implemented in 
coopération with ail stakeholders and international expert bodies. These efforts should be 
supported by increased international coopération. Within this global culture of cyber-security, 
it is important to enhance security and to ensure the protection of data and privacy, while 
enhancing access and trade.” (Section B5, paragraph 35) 

Some economists may argue that it is prohibitively costly to educate everyone by a 
spécifie institution in a spécifie opportunity at the same time. However, we cannot ignore 
opportunities for the effective spreading cybersecurity knowledge to any size of audience. 

(iii) Raising law-abiding consciousness 

Education for the development of a law-abiding conscience follows a tradition of earlier 
générations, such as Cesare Beccaria. 379 However, law and order in cyberspace has no 
precedent to follow. It remains disputable as to whether cyberspace constitutes the natural 
expansion of traditional society. Consequently, it is still arguable whether traditional laws and 
régulations should be applied to cyber activities, or whether traditional authorities should 
extend their grasp over a new space. The netizens who migrate to this lawless space behave 
unconstrainedly. Under cyber sub-culture, hackers defend themselves by their own codes and 
ethics, refuse to acknowledge the validity of State power, and ignore State jurisdiction over 
information Systems. The assumptions of an anarchie State without régulation or of an 
autonomie entity with self-regulation are prévalent among technological supremacists. 
Knowledge and skills make them technical dites on the one hand, ignorance of law and order 
makes them law-breakers on the other hand. However, in history, talent, knowledge and skills 
hâve never become the excuse for crime. Therefore, éducation is necessary to raise the 
379 Crime and Punishment, Chapter 45, 1764. 
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netizens’ law-abiding consciousness in cyberspace just as in society. This law-abiding 
consciousness falls mostly into the sphere of ethics as well. The “need for ethical 
management” and “implementing a code” (Bequai 1983, pp. 76-80) has long been recognized. 
Education in this aspect is a long-term and extensive task for many sectors. 

(iv) Developing security technology 

Before any scientific discovery and technological invention are made available to the 
general public, they are controlled in the hands of a few scientists and technicians, regardless 
of the possible impacts. Nothing about security is preferential. Only when incidents of broad 
hann to human beings became apparent did the scientific ethics begin to be emphasized in 
obviously hannful scientific activities. Priority should be given to a swift transition from an 
emphasis on usable technology to the development of a secure technology. The ICT industry 
has opportunities of developing security technology and of enhancing users’ self-protective 
ability. Information Systems can only be secured through a constantly updated technology, the 
development of new products, increased self-protection, and the closing of security gaps. 

(v) Security training 

Many factors erode the security protection of information Systems. Lack of security 
consciousness and security measures is the most usual reason why users cannot secure their 
System. Users do not hâve the incentive to adopt security measures unless their Systems are 
compromised. The usual examples of active participation in security training take place when 
users suffer losses or when administrative decree forces them to accept training. Users who 
benefit from security training are willing to receive further training. Nevertheless, in practice, 
security training is not always effective if it is operated as a market solution, because private 
trainers hâve the incentive of gaining pecuniarily from exaggerating risks and dangers, and 
from the effects of their training. Therefore, the training should better be organized by 
qualified institutions licensed by the public authorities. 

(vi) Establishing spécifie institutions 

Durkheim’s ideas concerning the social division of labour argue for specialized 
organizations in charge of crime prévention. This is because the establishment of institutions 
specialized in many different fields tends to fall into the hand of a bureaucracy. Social 
resources are wasted when many new institutions are established while many old institutions 
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are not disestablished. Cybercrime prévention is different. In fact, many countries hâve 
established numerous institutions at different levels and on different scales, being affiliated to 
or independent of other institutions. Independent institutions, equipped with their expertise 
and knowledge, would be more effective in reacting against urgent incidents. These 
institutions may take the form of a contact-point such as the 24/ Network designed by the 
Convention on Cybercrime. The Convention on Cybercrime has provided that each party 
should authorize a contact-point available on a twenty-four hour, seven-day-a-week base, to 
guarantee instant support in investigation and collection of evidence. 380 This provision 
requires member States to bear a round-the-clock responsibility for “immédiate assistance.” 381 

(vii) Reasonably monitoring online activities 

Although there are uncertain factors for maintaining law and order in cyberspace, 
criminal behaviour should be punished and prevented. The establishment of cyber police and 
cybercrime reaction forces in many countries meets the demand of security protection. One of 
the goals of a cyber police and of cybercrime reaction forces is to prevent and monitor 
harmful online activities, which usually happen within seconds and leaves no trace. The 
fundamental requirements for cyber police should be profound computing and networking 
knowledge and anti-hacking skills, as well as the potential to follow new developments of 
ICT. Because cybercrime can easily cross State borders, rapid reaction and the mutual 
assistance of cyber police between different countries is vital. 382 


380 Convention on Cybercrime, Article 35 24/7 Network. 

381 ibid.; see also HE 153/2006, General Justifications, 4 Effects of the Proposai. 

~ 82 More than any other recommendations, advice on policing the Internet would induce the biggest 
controversy and criticism, from organizations and groups such as the ACLU, ISPA, EFF, etc. 

The mission of the American Civil Liberties Union (ACLU) is to preserve freedom of speech, 
association and assembly, right to equal protection under the law, right to due process, and right to 
privacy. The Union is concerned about the issues including but not limited to anonymity on the web, 
Internet free speech, Internet privacy, Internet censorship, surveillance and wiretapping, and workplace 
privacy, etc. (see ACLU website, at http://www.aclu.org/). 

The Internet Service Providers’ Association (ISPA) strives for promoting compétition, 
self-regulation and the development of the Internet industry, and concerns about the issues such as 
political monitoring, etc. (see ISPA website, at http://www.ispa.org.uk). 

The Electronic Frontier Foundation (EFF) fights for the right to free speech, as detailed as the 
right to blog anonymously, the right to keep sources confidential, the right to make fair use of 
intellectual property, the right to allow reader's comments without fear, the right to protect the servers 
from government seizure, the right to freely blog about élections, the right to blog about the workplace, 
and the right to access the media (see EFF website, at http://www.eff.org/br/). 

See also other organizations or groups, for example the Internet Free Expression Alliance (IFEA, 
at http://www.ifea.net/), the Digital Freedom Network (DFN, at http://www.iia.org/dfn/), the Computer 
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(viii) Legislating on cybersecurity 

Consensus has not yet been reached on whether cyberspace should be regulated or 
deregulated. However, our discussion supports feasible and adéquate régulation, without 
which law and order in cyberspace cannot be maintained. At présent, the legal provisions on 
cybersecurity protection are scattered throughout criminal law, civil law, spécifie acts, 
régulations and decisions. It is necessary to implement a law specializing in cybersecurity 
protection, during which the lessons and expériences of various countries should be drawn 
upon to strengthen pertinence, systematism, and operability. The improved effectiveness of 
régulation and an increased severity in punishment would make it more costly to commit 
cybercrime, and discourage the potential criminals from taking the risk. 

(ix) Reinforcing judicial effectiveness 

The ICT promûtes the effectiveness of ail the social activities by making ail the 
participants informed. Cybercrime emerges as a side-product of ICT, which can both 
strengthen and weaken the effectiveness of the law enforcement based on the traditional social 
environment. The central problem is that the atmosphère of firee cyberspace has an extensive 
influence. When interception techniques are used in law enforcement, they usually induce 
disputes from different interest groups. The culture of security should be promoted by the 
adoption of relevant techniques by the law-enforcement agencies. 

(x) Coopération of the public-private sectors 

Cybersecurity is a relative conception and mixed provision is more efficient. 
Cybersecurity should be primarily maintained by the private sector, assisted by the public 
sector, represented by law enforcement. Because of conflict of interests and limited capacity, 
neither public sector nor private sector can undertake the whole task of cybersecurity 
protection alone. The absence of public-private coopération has been one of the critical 
problems in combating cybercrime (Syngress 2002, p. 2), lack of which just leaves loopholes 
in cybersecurity unfilled and exposes the vulnerabilities of information Systems. 


Professionals for Social Responsibility (CPSR, at http://cpsr.org/home), the Electronic Privacy 
Information Centre (EPIC, at http://www.epic.org/), and the Centre for Democracy and Technology 
(CDT, http://www.cdt.org/cda.html). 
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International society has recognized the importance of coopération in this field. 383 Three 
modes of public-private coopération should be considered: first, public-private partnership; 
second, public-supported private activities; and third privately-supported public activities. 
Previously, coopération was usually organized by the public sector and participated in by the 
private sector. The authoritative power and administrative function of the public sector played 
an important rôle in inducing a broad participation of individuals and enterprises, providing 
some kinds of éducation, training, raies, and coordination. The growing interests and forces of 
the private sector require a strengthened rôle in providing cybersecurity independently, or 
interdependently with the public sector. 

(xi) International coopération 

The international highway, railway and airway are limited to territory. The material 
existence of an information superhighway, however, only appears in sovereignties in the 
forms of cables and computers. The contents and activities of information Systems are 
intangible, Crossing locations distributed possibly anywhere along the “information 
superhighway.” The discussions in the previous chapters hâve offered abundant révélation 
that in the current greatly interconnected society, combating cybercrime nécessitâtes global 
cooperative endeavours, which is required in cybersecurity protection at various levels, 
including raising international and national levels of security consciousness, harmonizing 
substantive législations, filtering and intercepting trans-border infonnation traffic, furthering 
the exchange of detained judicial information, mutual assistance in criminal investigation, 
extradition of criminals, and other necessary fields. McConnell International has (2000, p. 8) 
proposed a “model approach” to cover both international coopération and private-public 
partnership to eradicate the legal vacuum. The “cominon criminal policy” as the Convention 
on Cybercrime furnishes can be seen as équivalent. 384 A consistent framework of legal policy 
constitutes the foundation of any international coopération. In international coopération, this 
means the necessary coordinated national police actions in search and seizure of stored data, 
real time collection of traffic data, interception of content data, and so on as provided in the 
Convention on Cybercrime (Articles 19-21). 

383 Council of Europe, Preamble, Convention on Cybercrime, Budapest, 23 November 2001. 
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The présent world powers remain intolérant of différences between communities, 
countries, and cultures. Ours is a world without awaiting and communication before State 
violence and wars corne into being. The failure of broader consensus and broader 
accommodation of the current international forum reminds the mutual proximity through 
international, intercultural and interrelated dialogue. The natural logic behind this world is 
that in a violent world, terrorism has been the excuse of endless wars (against the terrorists) 
and in infonnation society, cyber terrorism will be the excuse of future wars (against the 
cyber terrorists). It seems that international coopération in an equal and a tolérant platform is 
more than ever required. In the sense of money laundering, developed States, particularly 
those with a developed banking System, are legally doing far more than a poor country listed 
as the core of world concern can implicitly or explicitly do. 385 However, international 
pressure is more than ever put on the poor country rather than its developed counterparts. 
Therefore, future international coopération should be carried out in a more balanced way, an 
approach that should run through ail efforts for combating cybercrime. 

(xii) Reinforcing the deterrence of punishment 
Penal measures are the final remedy for cybersecurity breaches. If criminals are left 
unpunished, they will hâve a greater incentive to repeat their activities and gaining even more 
pecuniary profit from them. Legal history has not witnessed any substitutive measures for 
punishments, even though the types of punishments change over time. 386 The previous 
practice proves that deterrence of punishment has been greatly influenced by obstacles to law 
enforcement. The économie viewpoint on crime and justice argues that low probability of 
détection and inappropriate severity of punishment would minimize the overall deterrence 
(Becker 1968). In order to improve the deterrent effect of punishment, both investigation and 
conviction should be strengthened through a sériés of techniques and actions. Both national 


385 For example, Myanmar is currently the only country listed by Financial Action Task Force on 
Money Laundering (TAFT) as Non-Cooperative Countries and Territories (NCCT) in the field of 
anti-money laundering. See TAFT web site, 23 June 2006. Retrieved 15 March 2007, from 
http://www.fatf-gafi.Org/document/4/0, 2340, en_32250379_32236992_33916420_l_l_l_L00.html 

386 The most ancient punishments were characterised by physically exterminating or torturing 
criminals, including capital and corporal punishments, even though fine and imprisonment were 
similarly old. The later punishments became less bloody and less cruel, primarily depriving freedom 
and dignity. The latest tendency is that punishments indirectly related to the criminals’ life, health and 
freedom are broadly adopted, including fine, disqualification, community service, and probation. 
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and international legal instruments hâve been constantly making such efforts. 387 Nevertheless, 
there are also factors hindering the extreme efforts to reduce the crime-rate simply by 
increasing investment for improving law enforcement. It would be prohibitively expensive to 
produce a few effects on crime rate réduction. Therefore, no better alternative is open than 
that of giving comprehensive considération to the process of law enforcement in a detailed 
social context. 

(xiii) Establishing a victim compensation mechanism 

Cybercrime represents a way of transferring information, wealth, compétitive power, and 
psychological satisfaction from victims to perpétra tors. Most victims are usually those people 
with low risk-awareness and a low security level. Furthermore, the victims of cybercrime are 
generally reluctant to report crimes. They worry that public authorities cannot remedy past 
damage but can cause further losses by weakening public réputation and inducing future 
attacks. Victim compensation mechanisms increase the incentives of victims to report crimes 
and provide evidence, with the help of which they can recover part of losses. Because 
compensation imposes an extra financial burden on the perpetrators, it also créâtes incentives 
to discourage the potential criminals from compromising information Systems. Ideally, the 
dual incentives thus created will decrease the number of cybercrimes. 

(xiv) Eliminating négative incentives in cybersecurity protection 

Cybersecurity involves many different interest groups who benefit from different 
activities. System developers attempt to reduce costs for improving the security of software. 
Computer users attempt to reduce their investment on security measures. Security service 
providers hâve the incentive to exaggerate the risks, dangers, number and losses of insecurity 
incidents. The mass media also hâve the incentive to attract more readers, audience, 
advertisers, and marketers. Even the police and professors hâve the possibility of benefiting 
from increased expenses on research and development, as was mentioned in Chapter 7 
Section 7.13. On the other hand, some individuals and institutions hâve an incentive to 


387 For example, the Council of Europe Convention on Cybercrime, European Union Framework 
Decision on Attacks against Information System, HE 153/2006 of Finland, and so forth. The 
mechanisms include the acquiring and fixing of digital evidence, duty of witness, international 
information exchange, etc. 
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underestimate the genuine threat of cybercrime. Countermeasures must be taken to eliminate 
these incentives that distort truths and exploit these distorted truths of cybersecurity. 

(xv) Drawing out lessons from the expériences of traditional crime-prevention practice 
Although cybercrime has many characteristics different from traditional offences, it is a 
natural development of criminal phenomena, playing an interférence opportunities brought 
about by information Systems. The past lessons in failed efforts and expériences in successful 
endeavours hâve an organic relationship with current and future-policy design. In fields such 
as the deterrence of juvénile delinquency, international trafficking of human beings, drug 
control, and prévention of violence, the existing criminal-justice System proves constructive. 
The cybercrime scene is less violent, but there are still éléments that can be addressed by 
ordinary methods, such as raising a law-abiding consciousness, by constructing an online 
community, and by the establishment of an information security culture. 

With ail these measures, our intent is to increase the effectiveness of deterrence and to 
reduce the benefits of cybercrime, ensuring that the existing and potential perpetrators will be 
less satisfied. Mathematical methodology usually reduces crime prévention to some numerical 
indicators unreliably. Schweinhart, Barnes, and Weikart (1993) found that each dollar spent 
on crime prévention would ultimately save seven dollars (cited in Levinson 2002, p. 696). We 
could hardly anticipate that this kind of précisé calculation of the préventive effect would 
ensure a constructive method for providing generalized policy recommendations. 
Mathematical or statistical methods are typically overused and misleading in contemporary 
social sciences. Although it is unreasonable to suppose that spending more money would 
reduce the losses caused by cybercrimes, or simply decrease the number of cybercrimes, 
measures against cybercrime will definitely involve more investment. Besides pecuniary 
involvement, many other aspects of social forces should in addition be taken into account to 
enforce the counter-cybercrime efforts. Thus, both money and staff will hâve to be dumped 
into this endless circulation of crime and anti-crime, or anti-social behaviour and 
anti-anti-social endeavour. While criminal phenomena are a comprehensive erodent to the 
économie society, the distinct measures undertaken against them must be integrated in order 
to deter intrigue against the prosecution of offences. In this way, the abandoned hope of 
society may be restored to it. Great challenges necessitate powerful commitment. 


356 



The long-term and sustainable actions are to be aimed at the réduction of factors 
benefiting the occurrence of cybercrime and the augmentation of factors benefiting the 
maintenance of cybersecurity. This nécessitâtes a social-control model through a relatively 
open and decentralized legal System, overcoming the closed and centralized faults inherited 
firom the tradition of legalism. Furthermore, law is reduced by information Systems into a 
minor method of social control, from the starting-point where it was once the dominant 
method, or at least a parallel method to other social-control methods. There is hardly a legal 
superhighway that leads to the normalization of the infonnation superhighway. 
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ABSTRACT 


Society is undergoing automization, digitalization, spread of information, and 
networking, brought about by the broad adoption of information and communications 
technology (ICT). Infonnation Systems create not only advantages, convenience and 
efficiency, but also disadvantages, challenges and threats. Législation is usually not prompt 
nor adéquate enough to address technology-oriented social problems. The potential abuse of 
information Systems has long been uncontrollable. Cybercrime has a deeply négative 
influence on the development of an information society. 

Considering the routine-activity theory and the social disorganization theory, the 
dissertation explores the conceived challenges created by the development of an information 
technology confronting the traditional social-control System. The dissertation analyses the 
history, définition, characteristics, and classifications of cybercrime. It advocates a définition 
in a broad sense, in which it identifies characteristics of cybercrime and their négative 
influence on the probability of détection and effectiveness of deterrence. Current legal 
frameworks on cybercrime, either outdated or updated, either intra-national or international, 
are found ineffective in combating cybercrime. The key understanding of this dissertation is 
that, in order for the information society to be protected and the effectiveness of legal 
deterrence to be guaranteed, it is impérative to élimina te legal and jurisdictional gaps 
between countries, and between méat space and cyberspace so as to hold the criminal 
subjects liable. 

Keywords: Infonnation society, cybersecurity, cybercrime, deterrence 
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